Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the
Analysis Summary
# Vulnerability: Gitea Remote Code Execution via Malicious Git Hooks
## CVE Details
- **CVE ID:** CVE-2026-60004
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Code Injection / Improper Input Validation
## Affected Systems
- **Products:** Gitea
- **Versions:** All versions from 1.17 up to (but not including) 1.27.1.
- **Configurations:** Vulnerable by default when open registration is enabled (`DISABLE_REGISTRATION = false`). The attack vector is reachable via HTTPS even if SSH is disabled.
## Vulnerability Description
The vulnerability exists in Gitea's `diffpatch` API endpoint. An attacker with repository write access can send a malicious patch to this endpoint to plant an executable Git hook within the repository-controlled content. Because Gitea executes these hooks during certain operations, the attacker can achieve remote code execution (RCE) on the host operating system, running commands with the privileges of the Gitea service account.
## Exploitation
- **Status:** Exploited in the wild. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Low (Exploitation is straightforward once write access is obtained).
- **Attack Vector:** Network (HTTPS). Unauthenticated actors can exploit this on default installations by registering a new account and creating a new repository to gain the necessary "write" permissions.
## Impact
- **Confidentiality:** High (Total compromise of the Gitea service account and hosted data).
- **Integrity:** High (Ability to modify code and system files).
- **Availability:** High (Observed exploitation involves cryptojacking, which exhausts CPU resources).
## Remediation
### Patches
- Update Gitea to version **1.27.1** or later immediately.
### Workarounds
If patching is not immediately possible, administrators should restrict the ability for untrusted actors to gain write access:
- Set `DISABLE_REGISTRATION = true` in the Gitea configuration to prevent new unauthorized users from creating accounts.
- Enable `REGISTER_EMAIL_CONFIRM = true` to add a layer of verification.
- Enable `REQUIRE_SIGNIN_VIEW = true` to prevent unauthenticated API/web access.
## Detection
- **Indicators of Compromise:**
- High CPU usage (70%+) on the Gitea host (indicative of miner payloads).
- Presence of unknown executable files in the Gitea service's temporary or repository directories.
- Unexpected processes attempting to kill high-CPU tasks or clearing `LD_PRELOAD`.
- Log entries showing suspicious activity at the `/diffpatch` endpoint from newly created accounts.
- **Detection methods and tools:** Monitor system process lists for unauthorized miners and audit Gitea registration logs for automated or suspicious account creation.
## References
- **Gitea Advisory:** hxxps[://]gitea[.]com/gitea/advisory (Referenced via The Hacker News)
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Original Report:** hxxps[://]thehackernews[.]com/2026/08/critical-gitea-rce-actively-exploited.html
- **Technical Analysis (Habr):** hxxps[://]habr[.]com/ru/articles/1072030/