Gitea RCE flaw CVE-2026-60004 exploited in the wild, CISA sets August 28 patch deadline
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on August 25 and ordered federal civilian agencies to patch by August 28; the flaw lets anyone with repository write access abuse Gitea's diffpatch endpoint to install and run a Git hook, executing shell commands as the Gitea service account. With open registration on, that write access is one signup away — in one reported compromise an automated scanner registered an account and dropped a cryptominer, with the active phase lasting about 11 seconds. Any self-hosted Gitea below 1.27.1 is remotely executable by an anonymous visitor; 1.27.2 is the current fixed release, and disabling open registration closes the unauthenticated path.
Source: helpnetsecurity.com ↗
An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user.
Why this matters
- → Active RCE exploitation of Gitea; CISA emergency patch deadline for federal agencies.
- → Unauthenticated attack path: open registration + no email verification = instant write access.
- → 11-second compromise window; cryptominer deployed; secrets/creds exposed if Gitea OS user privileged.