Skip to content
Christopher Shaun Godwin cgodwin.io
Blog

Gitea Has a Critical RCE Being Exploited Right Now — Patch to 1.27.1

Christopher Shaun Godwin
Author

CISA added a critical Gitea remote code execution (RCE) flaw to its Known Exploited Vulnerabilities catalog on August 25, 2026, after confirming attackers are using it in the wild (CISA, 2026). The flaw is tracked as CVE-2026-60004 and carries a CVSS score of 9.8 (Help Net Security, 2026).

If you self-host Gitea, this is a patch-today situation. Attackers are already dropping miner-like payloads on vulnerable servers (The Hacker News, 2026). A successful exploit runs shell commands as the Gitea service account, which means full code execution on the machine that hosts your repositories.

What the vulnerability is

Section titled “What the vulnerability is”

CVE-2026-60004 is a code injection flaw, classified as CWE-94, inside Gitea’s diffpatch feature (SecurityWeek, 2026). Gitea is an open-source, Go-based Git platform that teams host on their own servers (Help Net Security, 2026). The bug lets an attacker who holds write access to a repository push a malicious patch to the diffpatch endpoint and plant an executable Git hook that runs shell commands as the Gitea service account (CISA, 2026).

The attack chain

Section titled “The attack chain”

The exploit does not crash the platform with a packet flood. It uses Gitea’s own patch machinery.

  1. The attacker submits a tricked patch to the diffpatch endpoint, which lives on the repo path (/api/v1/repos/{owner}/{repo}/diffpatch).
  2. Gitea runs the patch through Git’s apply inside a temporary bare clone (runZero, 2026).
  3. A crafted add/add collision in the patch content lets the attacker write an executable Git hook into the repository directory (runZero, 2026).
  4. Gitea and Git then execute that hook as the Gitea service account (SecurityWeek, 2026).

The result is remote code execution on the host. An attacker who controls the Gitea service account can read repositories, steal secrets from hooks or environment, and pivot to the wider internal network (BleepingComputer, 2026).

Which versions are affected

Section titled “Which versions are affected”

The advisory stretches versions from 1.17 up to, but not including, 1.27.1 (runZero, 2026). Exploitation also depends on Git version 2.32 or newer and an enabled diffpatch route (SecurityWeek, 2026). Gitea shipped the fix in version 1.27.1 (Gitea Security Advisories, 2026).

A rough blast radius estimate is straightforward. Open-registration instances let anyone sign up and create a repository (FOFA note, 2026). With write access already granted, the attacker skips the hardest part of the chain.

What CISA ordered

Section titled “What CISA ordered”

CISA placed CVE-2026-60004 into its Known Exploited Vulnerabilities catalog with a tag that it is also used to infect systems with ransomware (CISA KEV Catalog, 2026). Federal agencies must patch within their binding operational directive window, laid out as a three-day deadline (BleepingComputer, 2026).

What to do now

Section titled “What to do now”
  • Upgrade every Gitea server to version 1.27.1 or later. This is the single effective fix (Gitea Security Advisories, 2026).
  • Treat any public Gitea as exposed until upgraded (BleepingComputer, 2026).
  • Review which IPs can reach the diffpatch endpoint and disable the route if your workflow does not use it.
  • Disable open registration (unsigned-up instance signup) so strangers cannot self-register and obtain write access (The Hacker News, 2026).

Self-hosted DevOps platforms are a high-value target for attackers precisely because they cluster code and secrets in one trust zone (Help Net Security, 2026). The security reaction pattern of the developer ecosystem is now very consistent: KEV catalog entry, patch, then fresh scrutiny of any self-hosted Git forge. Patch first, plan after.

Tags: