Critical Gitea RCE Under Active Exploitation: CVE-2026-60004 Turns a Signup Form Into Shell Access

TL;DR

what: CISA confirmed active exploitation of CVE-2026-60004, a CVSS 9.8 code injection flaw in Gitea's diffpatch API that plants an executable Git hook and runs shell commands as the Gitea service account.

impact: Any user who can write to a repository gets remote code execution on the Gitea host, and with default open registration that user can be a stranger who registered an account minutes earlier; one reported victim had a miner-like dropper burn more than 70 percent of their VPS CPU until the hosting provider throttled them.

fix: Upgrade to Gitea 1.27.1, then set DISABLE_REGISTRATION to true, REQUIRE_SIGNIN_VIEW to true, and audit every repository for hooks planted before the patch.

who: Every organization running a self-hosted Gitea instance from 1.17 through 1.27.0, especially internet-facing instances with open registration, plus U.S. federal civilian agencies bound by the KEV deadline.

Critical Gitea RCE Under Active Exploitation: CVE-2026-60004 Turns a Signup Form Into Shell Access

Other newsrooms on this story

Related reading

New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like…

CISA Warns of Exploited Gitea Vulnerability

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Gitea Vulnerability Exposed 30,000 Deployments to Attacks

One Header, Full Admin: Attackers Exploit Critical Auth Bypass in Gitea Docker…