Gitea RCE Under Active Attack: CVE-2026-60004 Lets Anyone With Write Access Run Shell Commands — Patch to 1.27.1 Now

If you self-host Gitea, stop reading and upgrade to 1.27.1. CVE-2026-60004, a critical remote code execution flaw rated CVSS 9.8, is being actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on August 25 with a remediation deadline of August 28 for federal agencies.

The bug lives in Gitea’s diffpatch endpoint. An attacker with ordinary write access to any repository can abuse it to plant an executable Git hook from repository-controlled content. When the hook fires, the attacker’s shell commands run with the full privileges of the Gitea service account. No admin rights required, no privilege escalation chain — just a repo you can push to.

That “write access required” precondition sounds reassuring. It isn’t. Any Gitea instance with open registration, a compromised contributor account, or a disgruntled collaborator hands an attacker everything they need. Every Gitea version from 1.17 onward is affected, which covers roughly four years of releases.

It’s already being used to drop miners

This isn’t a theoretical proof-of-concept. Help Net Security and The Hacker News documented a real-world incident in which an unknown threat actor exploited CVE-2026-60004 on a developer’s self-hosted instance and deployed a cryptocurrency-miner-like dropper. The victim only noticed because their VPS provider flagged sustained CPU usage above 70%. Miners are the canary: the same access lets an attacker read every private repository, steal CI secrets, and tamper with source code.

The exposure surface is significant. Researchers count around 5,000 Gitea instances reachable directly from the internet, and that figure excludes the much larger population of instances on internal networks — which are still exploitable by anyone with an account.

What to do right now

• Upgrade to Gitea 1.27.1. That release patches the flaw. There is no supported mitigation that lets you stay on a vulnerable version safely.
• Can’t upgrade today? Restrict write access to trusted accounts, disable open registration, and take the instance off the public internet until you can.
• Assume compromise if you’re exposed. Check for unexpected Git hooks in repository directories, review processes running as the Gitea user, and rotate any secrets stored in repos or CI variables.

Self-hosted Git forges are prime supply-chain targets: they hold source code, deployment credentials, and the commit history your builds trust. Gitea is popular precisely with the small teams and homelabbers least likely to have monitoring that catches a quiet miner — or a quieter backdoor. The KEV listing means exploitation is confirmed, widespread scanning is inevitable, and the window between “patched” and “pwned” is measured in days.

Upgrade first. Investigate second.

Sources

• The Hacker News
• Help Net Security
• BleepingComputer