CISA has added a critical remote code execution flaw in the Gitea code hosting platform to its Known Exploited Vulnerabilities catalog after attacks that dropped cryptocurrency miner payloads on victim servers.
The bug, CVE-2026-60004, carries a CVSS score of 9.8. An attacker with write access to a repository can abuse the diffpatch endpoint to plant a Git hook and run shell commands as the Gitea service user. Because Gitea allows open registration by default, anyone can create an account and a repository, then trigger the exploit without existing credentials.
Researcher Shai rod, also known as NightRang3r, reported the flaw. It affects every version since 1.17 and is patched in 1.27.1, with 1.27.2 the current release.
CISA gave no detail on who is exploiting the bug, but a developer on the Russian blogging platform Habr documented a real compromise. Their host flagged a server running above 70% CPU for an extended stretch. An automated scanner registered an account on their outdated instance, created a repo, and ran the chain in about 11 seconds. The attack cleared process environment variables, killed competing processes, fetched a payload by architecture, and executed it before deleting the file. The active stage then deployed a miner-like dropper inside the unprivileged Docker container, where it did not survive restarts.
No persistence was found. The operator later upgraded Gitea, disabled open registration, rotated secrets, and blocked outbound container traffic.
US federal agencies must patch by August 28. Gitea admins should upgrade, close self-registration, and scan for signs of compromise.
