A massive security flaw (CVE-2026-60004) is being actively exploited, leaving over 8,300 Gitea instances at risk of remote code execution and malware deployment.

  • Critical vulnerability CVE-2026-60004 identified in Gitea.
  • Over 8,300 servers remain unpatched despite available fixes.
  • Attackers are using the flaw to deploy cryptocurrency mining malware.
  • CISA has issued an emergency directive to US federal agencies.

The cybersecurity landscape is facing a significant threat as over 8,300 Internet-exposed Gitea instances remain vulnerable to a critical code injection flaw. According to the cybersecurity watchdog Shadowserver, these unpatched servers are being actively targeted by attackers performing remote code execution (RCE) attacks.

The Technical Breakdown of CVE-2026-60004

The vulnerability, designated as CVE-2026-60004, was originally reported by Salesforce security researcher Shai Rod. The flaw resides in the diffpatch API endpoint. By submitting malicious patches, an authenticated attacker can execute arbitrary shell commands with the privileges of the Gitea service account.

Read Also:US and Allies Alert on Russian Hackers Targeting Critical Infrastructure

What makes this particularly dangerous is Gitea's default configuration. Because self-registration is enabled by default, an unauthenticated attacker can simply register a new account, create a repository, and immediately trigger the vulnerability to gain control over the host system.

Why This Matters

BozokMedia analysis shows that this is not merely a theoretical risk. In-the-wild exploitation has been observed where threat actors are utilizing these unpatched servers to deploy cryptocurrency mining malware. This turns legitimate developer infrastructure into botnets for illicit financial gain, often without the administrator's immediate knowledge.

The combination of an RCE vulnerability and default open registration creates a perfect storm for automated, large-scale exploitation.

Governmental and Global Response

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has stepped in with urgency. CISA has added this flaw to its catalog of actively exploited vulnerabilities and has mandated that all Federal Civilian Executive Branch (FCEB) agencies patch their systems by August 28, under Binding Operational Directive 26-04.

Historical Context: Gitea serves as a vital self-hosted alternative to platforms like GitHub and GitLab. With over 400,000 installations globally, the scale of this vulnerability poses a systemic risk to the DevOps ecosystem and private software development pipelines.

Did You Know?: Hackers often target DevOps tools like Gitea to inject malicious code directly into the software supply chain.

Frequently Asked Questions

Question 1: How can I protect my Gitea installation?
Answer: Immediately upgrade to Gitea version 1.27.1 or later and consider disabling public self-registration in your configuration.

Question 2: Is this related to the previous Docker image vulnerability?
Answer: While both affect Gitea, this is a distinct issue (CVE-2026-60004) involving the diffpatch API, whereas the previous one (CVE-2026-20896) involved authentication bypass.