US Cybersecurity and Infrastructure Security Agency (CISA) has warned that a recently patched critical remote code execution vulnerability affecting Gitea is being actively exploited in the wild. The flaw, tracked as CVE 2026 60004 and assigned a CVSS score of 9.8, has been added to the agency Known Exploited Vulnerabilities catalog after evidence of active attacks emerged. According to Gitea, the vulnerability allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea operating system user by abusing the platform diffpatch endpoint. The issue affects all Gitea versions beginning with version 1.17 and has been addressed in version 1.27.1. Security researcher Shai Rod, also known as NightRang3r, has been credited with discovering and responsibly reporting the vulnerability.
According to Gitea advisory, the vulnerability allows repository controlled content to install and execute a malicious Git hook through the diffpatch application programming interface. Although exploiting the flaw requires authentication and repository write permissions, the default configuration of Gitea allows new users to register accounts and create repositories without administrative approval when open registration is enabled. This makes it possible for external attackers to obtain the required permissions without compromising existing accounts. CISA stated that attackers with repository write access can submit specially crafted patches through the vulnerable endpoint to execute shell commands under the Gitea service account. While the agency confirmed active exploitation by adding the flaw to its Known Exploited Vulnerabilities catalog, it did not disclose details regarding the threat actors involved or the specific attacks observed in the wild.
Additional insight into real world exploitation was provided by a full stack developer identified as Andrey, also known as Causelof, who described an incident involving a self hosted Gitea instance that was reportedly compromised using CVE 2026 60004. According to the published analysis, the attack came to light after the hosting provider HOSTKEY notified the administrator that the virtual private server had been consuming more than 70 percent of available processor resources for an extended period, resulting in temporary restrictions on CPU usage. The developer identified several configuration settings that contributed to the attack surface, including open user registration, disabled email confirmation, enabled OpenID registration, and unrestricted public access without requiring sign in. The reported attack was carried out over HTTPS rather than SSH, allowing a newly created user account to create a repository and obtain the permissions needed to exploit the vulnerability. Before deploying a miner like payload, the reported dropper script cleared selected environment variables, searched for high CPU processes, attempted to terminate competing workloads, downloaded an architecture specific payload, executed it from disk, and removed the downloaded file after execution. Although the payload itself was not analyzed in detail, the significant increase in processor utilization was considered consistent with cryptojacking activity targeting vulnerable Gitea systems.
It remains unclear whether the attack described by the developer directly influenced the CISA decision to classify the vulnerability as actively exploited or whether the agency identified additional exploitation targeting other organizations. Regardless of the source, the inclusion of CVE 2026 60004 in the Known Exploited Vulnerabilities catalog signals that organizations using affected Gitea versions should prioritize remediation. Federal civilian agencies in the United States have been instructed to apply the available security updates by August 28, 2026, while adopting a risk based approach for patch management. The incident also highlights the importance of reviewing default application configurations, limiting unnecessary account registration, and promptly applying vendor security updates to reduce exposure to publicly known vulnerabilities that can be exploited shortly after disclosure.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
