The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a critical code injection flaw in the Gitea self-hosted Git service.
- Critical vulnerability tracked as CVE-2026-60004 identified.
- Attackers can execute arbitrary shell commands via diffpatch API.
- CISA has ordered U.S. Federal agencies to patch within 3 days.
- Users must upgrade to Gitea version 1.27.1 immediately.
A major security crisis is unfolding in the DevOps ecosystem. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that malicious actors are actively exploiting a critical-severity vulnerability in Gitea, a widely used self-hosted Git service. This flaw allows attackers to gain significant control over vulnerable servers.
The vulnerability, identified as CVE-2026-60004 and discovered by Salesforce researcher Shai Rod, involves a sophisticated code injection technique. By leveraging the diffpatch API endpoint, an authenticated user with repository write access can submit malicious patches to execute arbitrary shell commands with the privileges of the Gitea service account. Alarmingly, because many default Gitea configurations allow self-registration, unauthenticated attackers can simply create an account and a repository to trigger the exploit.
Why This Matters
BozokMedia analysis shows that the implications of this exploit extend far beyond simple data breaches. Reports indicate that attackers are using these unpatched Gitea instances to deploy cryptocurrency mining malware. This turns legitimate business infrastructure into unauthorized mining rigs, consuming massive computational resources and potentially exposing the entire corporate network to further lateral movement.
Gitea's security team warned that an unauthenticated visitor can obtain necessary write access simply by registering an account and creating a repository.
Historical Background: Gitea was designed as a lightweight, self-hosted alternative to massive SaaS platforms like GitHub and GitLab. While this provides immense control and privacy to organizations, it also shifts the entire burden of security patching and configuration hardening onto the end-user, making them a prime target for automated exploit scripts.
Comparison: SaaS vs. Self-Hosted Security
| Feature | GitHub (SaaS) | Gitea (Self-hosted) |
|---|---|---|
| Security Responsibility | Provider-Managed | User-Managed |
| Vulnerability Impact | Global/Centralized | Localized/Decentralized |
| Configuration Control | Limited | Total |
In response to the active exploitation, CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog. Under Binding Operational Directive (BOD) 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies have been ordered to remediate the flaw by August 28. Meanwhile, cybersecurity watchdog Shadowserver reports nearly 5,000 Gitea instances remain exposed online, many of which may be vulnerable.
Frequently Asked Questions
1. How can I protect my Gitea instance?
The most effective defense is to upgrade your Gitea installation to version 1.27.1 or later immediately.
2. Can an attacker exploit this without an account?
Yes, if your Gitea instance has default 'self-registration' enabled, an attacker can create their own account to gain the necessary permissions.
