Back Oodaloop

CISA Warns of Exploited Gitea Vulnerability

Oodaloop • August 26, 2026

CISA says attackers are exploiting CVE‑2026‑60004, a Gitea code‑injection bug that allows anyone with repository write access to plant executable Git hooks and run commands as the service account. The flaw, patched in version 1.27.1, has been added to the KEV catalog with federal agencies ordered to update by August 28. Details on the attackers or their motives remain unclear, though another Gitea flaw, CVE‑2026‑20896, was also recently seen in the wild. Organizations using the self‑hosted platform are urged to apply patches promptly given the active exploitation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Gitea Vulnerability CVE-2026-60004 Actively Exploited A critical vulnerability in Gitea, tracked as CVE-2026-60004, is being actively exploited by attackers, allowing unauthorized users to execute arbitrary shell commands on vulnerable servers. This flaw affects self-hosted Gitea instances, particularly those with default configurations that permit self-registration. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to secure their servers by August 28, 2026. Gitea released version 1.27.1 on July 27, 2026, to patch this vulnerability. Reports indicate that attackers are deploying cryptocurrency mining malware on unpatched servers. CISA has emphasized the significant risks posed by this vulnerability to federal enterprises. Additionally, another critical vulnerability, CVE-2026-20896, was previously exploited in July 2026, indicating ongoing security challenges for Gitea users. 17 sources 73

CISA Warns of Exploited Gitea Vulnerability

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)