CISA Adds Gitea CVE-2026-60004 RCE to Exploited Vulnerability List
CISA has added CVE-2026-60004, a critical remote code execution vulnerability in Gitea, to its Known Exploited Vulnerabilities catalog after warning of active exploitation. The flaw has a CVSS score of 9.8, affects Gitea versions from 1.17, and was patched in Gitea 1.27.1.
The vulnerability allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea operating-system user. Gitea said its diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content.
Registration settings can lower the barrier
The affected API call requires authentication and repository write permission. However, Gitea allows registration by default, meaning an unauthenticated visitor may be able to register an account, create a repository, obtain write access there, and trigger the exploit without using pre-existing credentials.
CISA described the issue as a code injection vulnerability: a repository writer can send a malicious patch to the diffpatch API endpoint, plant an executable Git hook, and run shell commands under the Gitea service account. Security researcher Shai rod, also known as NightRang3r, is credited with discovering and reporting the flaw.
Reported attack linked to heavy CPU consumption
CISA did not identify the actors behind the exploitation or disclose technical details of attacks observed in the wild. Separately, full-stack developer Andrey, known online as @Causelof, reported that an unknown actor used CVE-2026-60004 against a Gitea instance to deploy a cryptocurrency-miner-like dropper.
The incident was detected after hosting provider HOSTKEY notified the user that the virtual server had consumed more than 70% of processor capacity for an extended period. The provider temporarily limited CPU resources on the VPS. Andrey said the instance had open registration enabled, email confirmation disabled, OpenID signup enabled, and no sign-in requirement to view pages or use the API.
The reported attack used HTTPS rather than exposed SSH. Before deploying its next-stage payload, the dropper reportedly cleared LD_PRELOAD and LD_LIBRARY_PATH, searched for high-CPU processes, attempted to terminate competing processes, selected a payload for the host architecture, downloaded and ran it, then deleted the file.
Payload attribution remains unconfirmed
Andrey did not analyse the payload contents and said there was no confirmed information about a mining pool, wallet, miner family, or operator. The reported CPU spike nevertheless aligns with cryptojacking activity against vulnerable Gitea instances.
It remains unclear whether CISA’s KEV listing was prompted by that reported incident or by other evidence of attacks against unpatched servers. Federal civilian agencies must remediate the vulnerability by August 28, 2026, while prioritising updates through a risk-based approach.
For organisations running Gitea, the immediate business implication is to upgrade to 1.27.1, review registration and access settings, and investigate unusual CPU demand, repository changes, and service-account command execution for signs of compromise.