Hackers now exploit critical Gitea flaw in code injection attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the self-hosted Git service Gitea to its Known Exploited Vulnerabilities catalog, following reports of active exploitation. The flaw, tracked as CVE-2026-60004, allows an authenticated user with repository write access to execute arbitrary shell commands on the server. This affects organizations running vulnerable Gitea instances, particularly those with default settings that permit open registration.

The vulnerability was reported by Salesforce security researcher Shai Rod and involves a code injection issue in the diffpatch API endpoint. An attacker can submit malicious patches through this endpoint to install and execute a Git hook from repository-controlled content, gaining the ability to run shell commands as the Gitea operating system user. Gitea’s security team notes that because default-configured instances have self-registration enabled, an unauthenticated visitor can simply register an account and create a repository to obtain the necessary write access.

Gitea released version 1.27.1 on July 27 to fix the flaw and has urged users to upgrade their servers as soon as possible. The cybersecurity watchdog Shadowserver currently tracks nearly 5,000 Gitea instances exposed online, though it is unclear how many of those are honeypots or have already been patched. CISA did not provide specific details about the attacks, but the agency’s action suggests active exploitation in the wild, with reports indicating attackers have used the flaw to deploy cryptocurrency mining malware on unpatched servers.

On Tuesday, CISA ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days, by August 28, as required by Binding Operational Directive 26-04. The agency warned that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Although the directive applies only to FCEB agencies, CISA encourages all organizations to prioritize remediation of vulnerabilities listed in the KEV catalog.

This is not the first time Gitea has been targeted this year. In July, threat actors were also observed exploiting a critical authentication bypass vulnerability, tracked as CVE-2026-20896, in attacks against Gitea instances that had reverse proxy authentication headers, such as X-WEBAUTH-USER, enabled. That earlier flaw underscores the ongoing interest from attackers in self-hosted development platforms, which often hold sensitive source code and infrastructure credentials.

The active exploitation of CVE-2026-60004 highlights the risk facing organizations that self-host their development tools. While cloud-hosted platforms like GitHub and GitLab manage security centrally, self-hosted services require administrators to stay current with patches and harden their configurations. CISA’s inclusion of this flaw in its KEV catalog signals that federal agencies and private sector organizations alike should treat it as an immediate priority for remediation.

More cybersecurity news from TechManNews.