Over 8,300 Gitea servers vulnerable to code execution attacks

More than 8,300 internet-exposed Gitea servers remain unpatched against a critical code injection vulnerability that attackers are actively exploiting in remote code execution campaigns, according to cybersecurity watchdog Shadowserver. The flaw, tracked as CVE-2026-60004, was reported by Salesforce security researcher Shai Rod and allows authenticated attackers to run arbitrary shell commands with the privileges of the Gitea service account. Exploitation works by submitting malicious patches through the diffpatch API endpoint, which can be abused to install and execute a Git hook from repository-controlled content.

Successful attacks require repository write access on vulnerable servers, but Gitea ships with self-registration enabled by default. That means an unauthenticated visitor can register an account, create a new repository, and trigger the vulnerability without any prior credentials. Gitea’s security team has publicly explained that anyone with ordinary write access to a repository can execute shell commands as the Gitea operating system user.

Gitea addressed the flaw in version 1.27.1, released on July 27, and urged administrators to upgrade immediately. Despite that patch, Shadowserver reported that its scanning found 8,393 vulnerable IP addresses as of 2026-08-27. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004 to its catalog of actively exploited flaws on Tuesday and ordered Federal Civilian Executive Branch agencies to patch within three days, by August 28, under Binding Operational Directive 26-04.

CISA has not released additional details about attacks exploiting the vulnerability, but the agency’s action was likely driven by reports of in-the-wild exploitation where threat actors are deploying cryptocurrency mining malware on unpatched Gitea servers. The agency warned that this type of flaw is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. The directive applies specifically to U.S. civilian agencies, underscoring the federal exposure to self-hosted code hosting platforms.

In a separate incident from July, threat actors were also observed abusing another critical vulnerability in the official Gitea Docker image. That flaw, tracked as CVE-2026-20896, is an authentication bypass affecting instances with reverse proxy authentication headers enabled. Gitea is a self-hosted alternative to cloud-based platforms such as GitHub, GitLab, and Bitbucket, with more than 400,000 installations and roughly 1,500 contributors.

The continued exposure of thousands of servers highlights a broader pattern where patching lags behind public disclosure and active exploitation. While the vendor has provided a fix, the large number of unpatched instances suggests many administrators have not yet updated their deployments. Shadowserver’s scanning data offers a clear snapshot of the remaining attack surface, and the CISA directive adds urgency for federal systems specifically.

More cybersecurity news from TechManNews.