CISA flags critical Gitea flaw exploited in the wild
A critical remote code execution flaw in Gitea, tracked as CVE-2026-60004, has been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog after attacks were observed in the wild. The vulnerability, with a CVSS score of 9.8, affects Gitea instances running versions from 1.17 up to 1.27.0 and is fixed in 1.27.1. Because Gitea enables open registration by default, unauthenticated attackers can create accounts, repositories, and weaponize the flaw without prior access.
A backdoor in the diffpatch API
The issue lies in the diffpatch API, which can be abused to plant and execute malicious Git hooks. When triggered, the hook runs arbitrary shell commands under the privileges of the Gitea service user, effectively granting full control over the host. Researchers report that at least one incident involved deploying a cryptocurrency-miner-like payload on an exposed Gitea server that allowed anonymous web access.
A tight deadline for federal patches
Under Binding Operational Directive 22-01, U.S. federal civilian executive branch agencies must remediate all cataloged vulnerabilities by the specified due date—August 28, 2026 in this case—to reduce exposure to active exploits. While the directive applies directly to government networks, CISA urges private organizations to treat the catalog as a priority patching guide and to confirm whether their Gitea deployments are vulnerable.
Why it matters
This catalog addition signals that CVE-2026-60004 is already being leveraged by attackers, raising the stakes for any organization running a self-hosted Git platform. Even a single misconfigured or outdated instance can become an entry point for supply-chain compromise or resource hijacking. Given Gitea’s widespread use as a lightweight GitHub alternative, organizations should audit instances immediately, disable open registration where possible, and apply the 1.27.1 update to close the attack path.
Source: Security Affairs. AI-assisted editorial synthesis — TechnoExpress.