Gitea RCE Under Active Exploitation — CVSS 9.8, Cryptojacking Campaign Confirmed
CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a critical remote code execution vulnerability in Gitea, the widely deployed self-hosted Git platform. The flaw carries a CVSS score of 9.8 and federal agencies have until August 28 to patch.
What's Happening
The vulnerability exists in Gitea's diffpatch API endpoint. An attacker with repository write access can send a malicious patch to plant an executable Git hook and execute arbitrary shell commands as the Gitea service account. Because Gitea allows open registration by default, an unauthenticated external actor can create an account, create a repository, and trigger the exploit without needing pre-existing credentials. All versions from 1.17 onward are affected. The fix shipped in version 1.27.1, released in late July.
CISA's KEV listing was prompted by confirmed in-the-wild exploitation. A public incident report from a Gitea operator describes an attacker leveraging CVE-2026-60004 to deploy a cryptocurrency-mining dropper. The attacker registered an account, created a repository, exploited the diffpatch endpoint, and planted a Git hook that executed a multi-stage payload. The dropper cleared environment variables, killed competing high-CPU processes, fetched architecture-appropriate binaries, executed them, and cleaned up after itself. The hosting provider flagged the VPS for sustained CPU violations before the operator discovered the compromise.
Why This Matters Now
Gitea is popular with organisations that want Git hosting without relying on GitHub or GitLab. Many of those deployments run with default open registration enabled, making the attack path from "unauthenticated outsider" to "root-level code execution" achievable in minutes. Shadowserver data and security firm reconnaissance suggest a sizable number of internet-facing Gitea instances remain unpatched. The exploit does not require credentials, does not require user interaction, and works over HTTPS, making perimeter defences irrelevant if the Gitea web interface is reachable.
This is also the second significant supply-chain-adjacent development this week targeting developer infrastructure, following the Oracle WebLogic nation-state campaign covered earlier today.
So What / Action
Inventory every Gitea instance in your environment, including those behind VPNs. If you are running any version below 1.27.1, upgrade immediately. If open registration is not required, disable it now: set `DISABLE_REGISTRATION = true` and `ENABLE_OPENID_SIGNUP = false` in your Gitea configuration. Enable `REQUIRE_SIGNIN_VIEW = true` to force authentication for all page access. Check Git hook directories (`.git/hooks/`) on existing repositories for unexpected executables. Review Gitea access logs for new account registrations from unfamiliar IP addresses and repositories containing suspicious patch files. If patching is not immediately possible, place Gitea instances behind an authentication reverse proxy until the update is applied.