The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a critical-severity Gitea vulnerability in code injection attacks. Tracked as CVE-2026-60004 and discovered by Salesforce security researcher Shai Rod, the flaw allows authenticated users with repository write access to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint.
How the Gitea Vulnerability Works
Gitea is a self-hosted Git service that provides a full suite of DevOps tools, similar to cloud-hosted platforms like GitHub or GitLab. The Gitea vulnerability stems from how the diffpatch endpoint handles Git hooks. According to Gitea’s security team, “an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user” by abusing this endpoint to install and execute a Git hook from repository-controlled content.
The catch: default-configured Gitea instances have self-registration enabled, meaning unauthenticated attackers can register an account and create a new repository without prior credentials, then trigger the Gitea vulnerability without needing legitimate access. This dramatically lowers the barrier to exploitation and explains why the flaw poses such a significant risk.
Active Exploitation and Urgent Patching Orders
Gitea released version 1.27.1 on July 27 to address CVE-2026-60004, and the company advised users to upgrade immediately. Cybersecurity watchdog Shadowserver now tracks nearly 5,000 Gitea instances exposed online, though it remains unclear how many have already been patched or are honeypots.
On Tuesday, CISA added the Gitea vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. Federal Civilian Executive Branch agencies to secure their servers within three days, by August 28, under Binding Operational Directive 26-04. Reports indicate attackers have already deployed cryptocurrency mining malware on unpatched Gitea servers. CISA emphasized that “this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” While the directive applies only to federal agencies, CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities as part of risk-based vulnerability management.
المصدر: BleepingComputer
-
-
-
-
-
-
-
-
-
-
-
Show Comments[…] which regularly uncovers upcoming features in WhatsApp‘s test versions. As covered earlier, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted how attackers exploit security gaps in other platforms, and in a related development, […]
[…] a broader pattern of supply-chain attacks targeting browser extensions. As covered earlier, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted how critical vulnerabilities in development tools can be weaponized at scale. […]
[…] covered earlier, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted how attackers exploit valid credentials once they gain initial access—a pattern that […]
[…] you won’t lose critical data if your device is stolen or lost. In a related development, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted how attackers exploit code injection vulnerabilities, underscoring the importance of […]
[…] within the United States itself. This follows a pattern seen in related developments, such as CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks which highlighted how attackers exploit legitimate infrastructure for malicious […]
[…] targeted Vietnamese manufacturing firms with an in-memory Rust loader. As covered earlier, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted similar zero-day exploitation patterns affecting critical infrastructure. In a related […]
[…] continues to function during temporary network disruptions. This follows a pattern similar to what CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks documented with other emerging threats targeting critical […]
[…] incident reflects a broader pattern of security challenges facing the company. As covered earlier, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted similar urgency around critical flaws. Additionally, NovaCookies Phishing Toolkit […]
[…] and hit exposed systems more quickly than before — a dynamic echoed in recent reporting, such as CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks, where a known flaw was weaponized for code injection soon after […]
[…] to watch for unusual peer-to-peer traffic, not just suspicious domains. In a related development, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks covered how attackers are finding other creative ways around standard defenses, and NovaCookies […]
[…] in .NET. Security teams juggling patches like this should also note the pattern described in CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks, another case where attackers moved fast on a disclosed flaw before defenders could fully […]