The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a critical-severity Gitea vulnerability in code injection attacks. Tracked as CVE-2026-60004 and discovered by Salesforce security researcher Shai Rod, the flaw allows authenticated users with repository write access to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint.
How the Gitea Vulnerability Works
Gitea is a self-hosted Git service that provides a full suite of DevOps tools, similar to cloud-hosted platforms like GitHub or GitLab. The Gitea vulnerability stems from how the diffpatch endpoint handles Git hooks. According to Gitea’s security team, “an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user” by abusing this endpoint to install and execute a Git hook from repository-controlled content.
The catch: default-configured Gitea instances have self-registration enabled, meaning unauthenticated attackers can register an account and create a new repository without prior credentials, then trigger the Gitea vulnerability without needing legitimate access. This dramatically lowers the barrier to exploitation and explains why the flaw poses such a significant risk.
Active Exploitation and Urgent Patching Orders
Gitea released version 1.27.1 on July 27 to address CVE-2026-60004, and the company advised users to upgrade immediately. Cybersecurity watchdog Shadowserver now tracks nearly 5,000 Gitea instances exposed online, though it remains unclear how many have already been patched or are honeypots.
On Tuesday, CISA added the Gitea vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. Federal Civilian Executive Branch agencies to secure their servers within three days, by August 28, under Binding Operational Directive 26-04. Reports indicate attackers have already deployed cryptocurrency mining malware on unpatched Gitea servers. CISA emphasized that “this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” While the directive applies only to federal agencies, CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities as part of risk-based vulnerability management.
المصدر: BleepingComputer
