Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-60004 | 9.8 | 86.8% | ✅ listed | — | 89.78 (Critical) |
Gitea RCE: Unauthenticated Attackers Run Shell Commands as the Git User
Gitea has disclosed a critical remote code execution vulnerability in its diffpatch API endpoint, tracked as CVE-2026-60004 and rated CVSS 9.8 (v3.1) with an EPSS score of 86.8% at the 100th percentile. The flaw allows an attacker with repository write access to plant an executable Git hook from repository-controlled content, then run arbitrary shell commands as the Gitea process user.
On default installations where open self-registration is enabled, an unauthenticated attacker can register an account, create a repository, and push malicious content to trigger the hook. Successful exploitation executes commands with the privileges of the Gitea service account, exposing the main configuration file, application and process-environment secrets, database credentials, and OAuth and integration credentials.
Gitea released version 1.27.1 on July 27, 2026 to fix the issue. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 25, 2026, ordering federal agencies to patch by August 28.
How the diffpatch Endpoint Turns a Patch into a Git Hook
The flaw lives in Gitea's diffpatch API endpoint, which applies user-supplied patches inside a temporary Git repository. In vulnerable releases, Gitea creates that temp clone as a bare repository, meaning the repository directory itself is Git's internal data directory. An attacker with write access manipulates the clone process so that repository-controlled content is materialized as an executable post-index-change hook rather than an ordinary file. Git then executes that hook during subsequent repository operations, running the attacker's shell commands as the OS user running the Gitea process.
The fix in version 1.27.1 changes the temporary clone from a bare repository to a non-bare one. That single change prevents the hook from being materialized as a post-index-change hook, since the repository directory is no longer Git's internal data directory in the same way. The patch was released on July 27, 2026, and affects Gitea 1.17 through 1.27.0.
Active Exploitation: Crypto-Miner Drops on Self-Hosted Gitea
A Russian full-stack developer, Andrey (@Causelof), reported on Habr that his self-hosted Gitea instance was compromised via CVE-2026-60004 after his VPS host, HOSTKEY, flagged the server for running above 70% CPU for an extended period. The instance ran an outdated Gitea build with open self-registration enabled and no email confirmation or CAPTCHA, leaving the RCE path open to unauthenticated visitors.
The observed attack chain executes as the git user inside the Gitea process. The attacker first writes a proof-of-RCE payload back into a Git branch, then downloads a universal shell-loader followed by a crypto-miner-like dropper. On the compromised host, the miner competed for CPU against other malware already present, consistent with the sustained high utilization HOSTKEY reported.
8,300+ Internet-Exposed Gitea Servers Still Unpatched
Shadowserver reports 8,300+ internet-exposed Gitea instances remain unpatched against CVE-2026-60004, up from roughly 5,000 cited days earlier. The count reflects confirmed-unpatched servers; there is no visibility into how many are honeypots or already secured.
Gitea has 400,000+ installations worldwide, making the exposed footprint a meaningful supply chain risk for self-hosted Git deployments.
Remediation: Upgrade to 1.27.1 and Disable Self-Registration
Upgrade to Gitea 1.27.1 or later is the only fix for CVE-2026-60004. The patch, released July 27, 2026, changes the temporary clone from a bare repository to a non-bare one, preventing the post-index-change hook from being materialized from repository-controlled content.
If open sign-up isn't required, disable self-registration by setting DISABLE_REGISTRATION = true in app.ini. This closes the lowest-effort path to exploitation, where an unauthenticated visitor registers an account and creates a repository to gain the write access needed for the diffpatch endpoint.
Restrict internet exposure of self-hosted Gitea instances. A related CVE-2026-59774, disclosed around the same time, allows unauthenticated attackers to enable servers and potentially chain into RCE, compounding the risk for organizations still running unpatched deployments.
Key points
- CVE-2026-60004 is a critical RCE in Gitea's diffpatch API endpoint, rated CVSS 9.8 (3.1) with EPSS 86.8% (100th percentile).
- Unauthenticated remote attackers can write malicious Git hooks via the diffpatch endpoint to execute arbitrary shell commands as the Gitea process user on default installs with open self-registration.
- Affected versions are Gitea before 1.27.1; the fix changes the temporary clone from a bare to a non-bare Git repository to prevent hook materialization.
- CISA added the CVE to its KEV catalog on August 25, 2026, ordering federal agencies to patch by August 28, 2026.
- Shadowserver reports over 8,300 internet-exposed Gitea instances remain unpatched, with active exploitation deploying crypto-miner payloads as the git user.
Further reading & sources
- Gitea vulnerability CVE-2026-60004: find impacted assets — RunZero
- Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) - Help Net Security
- Over 8,300 Gitea Servers Still Vulnerable to Active Code Execution Attacks | CosmicBytez Labs
- CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads | SOC Prime
- Hackers target Gitea servers with critical code injection flaw
- Hackers now exploit critical Gitea flaw in code injection attacks