Nearly 5,000 Gitea instances are exposed online — a concrete figure Shadowserver now tracks — and a critical code-injection flaw in the self-hosted Git service is being actively exploited, federal and vendor advisories say.
CVE-2026-60004: the technical vector
Tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, the vulnerability permits an authenticated user with repository write access to execute arbitrary shell commands with the privileges of the Gitea service account. The exploit path is specific: attackers submit malicious patches via Gitea’s diffpatch API endpoint, which can be abused to install and execute a Git hook from repository-controlled content.
Gitea’s security team described the risk plainly: “Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user.” That combination — a web API that accepts patch data and the ability to create repository-controlled hooks — is the operational detail that makes exploitation possible.
Default self-registration widens who can exploit it
Compounding the technical flaw, many Gitea installations ship with self-registration enabled. Gitea’s security team warned that “With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.” In other words, attackers do not necessarily need pre-existing credentials on a vulnerable server to trigger the bug if the instance uses the default configuration.
Gitea published a fix — version 1.27.1 — on July 27 and advised administrators to upgrade their servers as soon as possible.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleActive exploitation and observed payloads
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says attackers are actively exploiting the flaw on publicly reachable servers. While CISA did not provide extensive technical details about individual intrusions, the agency said attackers deployed cryptocurrency mining malware on unpatched Gitea servers.
Shadowserver’s count of nearly 5,000 online Gitea instances provides a sense of scale, but the group’s tally does not indicate how many of those are honeypots or have already been secured against CVE-2026-60004 attacks.
Federal directive: three-day patch deadline under BOD 26-04
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure affected servers within three days, by August 28, under Binding Operational Directive (BOD) 26-04. CISA framed the decision in stark terms: “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”
The agency also urged broader adoption of its approach: “While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.”
What this means for technologists, federal agencies, and self-hosted operators
- Technologists and security teams: Inventory and upgrade. Teams running self-hosted Gitea need to know whether their instances are internet-exposed, whether self-registration is enabled, and whether they have applied the July 27 update (Gitea 1.27.1) that addresses CVE-2026-60004.
- Federal agencies: Rapid compliance and verification. FCEB agencies are under a three-day BOD 26-04 order to secure servers by August 28; that requires not only patch deployment but confirmation that exposed instances were found and remediated.
- Open-source operators and maintainers: Default settings matter. The vulnerability’s practical reach is amplified by default-open registration on many instances, underscoring the operational impact of distribution defaults and the need to communicate configuration guidance alongside code fixes.
The facts in this episode are straightforward and urgent: a code-injection flaw in a widely deployed, self-hosted DevOps platform has a low bar for exploitation on default-configured systems, attackers have used it in the wild to deploy mining malware, and federal agencies have been ordered to remediate within days. Shadowserver’s count of nearly 5,000 exposed instances — without a clear breakdown of which are active, bait, or already secured — leaves a practical question: how many reachable servers remain vulnerable as the August 28 federal deadline approaches?
Original reporting: https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks/
