The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of a critical security flaw in Gitea, a widely used software platform. The vulnerability, identified as CVE-2026-60004 with a CVSS score of 9.8, permits remote code execution, allowing attackers to execute arbitrary shell commands.
Understanding the Gitea Security Flaw
This vulnerability affects all Gitea versions from 1.17 and was patched in version 1.27.1. The flaw is exploited by manipulating Gitea’s diffpatch endpoint, as detailed in an advisory by Gitea. The vulnerability can be leveraged by creating a repository with default open registration, enabling an unauthenticated individual to gain necessary write access.
Security researcher Shai Rod, also known as NightRang3r, discovered this issue. The vulnerability’s potential for exploitation lies in Gitea’s default settings, which allow external actors to create accounts and repositories, thus facilitating the execution of malicious codes without pre-existing credentials.
Exploitation Details and Impact
CISA’s addition of this flaw to its Known Exploited Vulnerabilities catalog underscores its severity. Although specific exploitation details remain undisclosed, a developer known as Andrey reported an attack using CVE-2026-60004 to deploy a cryptocurrency-miner-like payload on their Gitea instance. This incident was linked to unusual server activity detected by hosting provider HOSTKEY.
The attack exploited the open registration configuration in Gitea, allowing the attacker to register and gain repository write access. The vulnerability was accessed via HTTPS, with the attack vector avoiding exposure of Gitea’s SSH.
Mitigation and Ongoing Concerns
The payload involved a script that circumvented standard security processes, downloaded a miner, and executed it, significantly increasing CPU usage. While the precise nature of the payload remains unexamined, the activity aligns with cryptojacking campaigns targeting unpatched Gitea instances.
Federal agencies in the U.S. have been instructed to patch the vulnerability by August 28, 2026, prioritizing updates based on risk. It remains uncertain whether CISA’s catalog inclusion was due to this specific attack or other evidence of exploitation.
This incident highlights the critical importance of timely software updates and vigilant monitoring to prevent similar vulnerabilities from being exploited in the future.
