Hackers target Gitea servers with critical code injection flaw

Hackers are actively exploiting a critical security flaw in Gitea, a popular self-hosted Git service, the US Cybersecurity and Infrastructure Security Agency (CISA) has warned.

The vulnerability, CVE-2026-60004 , enables attackers to run arbitrary commands on affected servers with the same privileges as the Gitea service account.

Gitea is an open-source platform written in Go that organisations use to host and manage Git repositories on their own infrastructure.

The vulnerability was discovered by Salesforce security researcher Shai Rod and affects the platform's diffpatch API endpoint.

An attacker with write access to a repository can exploit the flaw by submitting a specially crafted patch, allowing them to install and run a malicious Git hook.

Gitea's security team said the vulnerability could be used to run shell commands as the operating system user running the Gitea service.

The risk is potentially greater for installations using their default settings.

Self-registration is enabled by default, meaning an attacker without an existing account may be able to register, create a repository and obtain the write access needed to exploit the vulnerability.

Gitea released version 1.27.1 on 27 July to fix the problem and has urged administrators to upgrade as soon as possible.

CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalogue on Tuesday, indicating that the flaw is being exploited in real-world attacks.

US Federal Civilian Executive Branch agencies have been given three days to secure affected systems, with a deadline of 28 th August under Binding Operational Directive 26-04.

CISA did not provide details the attacks or identify those responsible. It warned that vulnerabilities of this type are frequently used by malicious cyber actors and can pose significant risks to government networks.

Although the directive applies specifically to federal civilian agencies, CISA has urged other organisations to prioritise remediation of vulnerabilities listed in its KEV catalogue.

Ssecurity researchers have found evidence suggesting that vulnerable servers are already being targeted to install cryptocurrency-mining malware .

A recent analysis on Russian collaborative blog Habr by full-stack developer Andrey, known online as @Causelof, described an apparent attack against a Gitea instance using CVE-2026-60004.

The incident was discovered after the hosting provider HOSTKEY warned that the affected virtual server had been consuming more than 70% of its available processor capacity for an extended period.

The provider temporarily restricted the server's CPU resources after detecting the unusually high usage.

According to the analysis, a dropper used in the attack first searched for processes consuming large amounts of CPU and attempted to terminate competing processes.

It then downloaded a payload suited to the server's architecture, wrote it to disk, executed it and deleted the file afterwards.

Robert Coles, senior manager of threat intelligence at Black Duck, said the addition of the vulnerability to CISA's KEV catalogue should prompt organisations to treat the issue as an immediate security concern.

"Gitea often sits at the centre of an organisation's software supply chain, making it a high-value target for attackers. The fact that this vulnerability is being actively exploited and can be abused through default configurations significantly raises the risk for organisations that have not patched.

"Just as important, development platforms like Gitea should not be directly exposed to the Internet. They should be treated as critical infrastructure and only be accessible through approved access methods, strong authentication controls, and appropriate network restrictions.

"Organisations should prioritise patching affected systems immediately, verify that no instances are unnecessarily Internet-facing, and review exposed environments for signs of compromise before attackers have an opportunity to exploit them," Coles added.