Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation targeting a critical remote code execution flaw in Gitea, the popular self-hosted Git service. Tracked as CVE-2026-60004 (CVSS 9.8), the vulnerability allows any user with ordinary repository write access — including a newly self-registered account on instances with open registration — to execute arbitrary shell commands as the Gitea OS user.

Federal agencies have been given until August 28, 2026, to patch under CISA's Known Exploited Vulnerabilities (KEV) catalog mandate.

Technical Details

Root Cause: Git Hook Injection via Diffpatch

The vulnerability lives in Gitea's diffpatch endpoint, which applies attacker-controlled patch content inside a bare temporary clone. By submitting the same patch twice, an attacker triggers an add/add merge collision. Git's three-way merge fallback then writes attacker-supplied content into the repository's hook directory as a live Git hook named post-index-change — a hook Git executes automatically whenever it updates the index.

Because the hook runs with the privileges of the Gitea OS process, this converts a routine repository operation into arbitrary command execution — no admin access, no plugin, and no server misconfiguration required. On instances with open self-registration enabled (a common default), an unauthenticated visitor can obtain the write access needed to trigger the chain simply by signing up and creating a repository.

Exploitation in the Wild

A full-stack developer reported on the Russian blogging platform Habr that their self-hosted Gitea instance was compromised using CVE-2026-60004 to drop a cryptocurrency-miner-like payload. The compromise surfaced only after hosting provider HOSTKEY flagged the virtual server for sustained CPU usage above 70% — a service-terms violation that triggered automatic resource throttling before the owner noticed anything was wrong.

It remains unclear whether CISA's KEV addition stems specifically from this miner incident or from separate telemetry showing broader exploitation against unpatched, internet-facing Gitea servers. No prior evidence of active exploitation for this CVE had surfaced before the miner report. A working proof-of-concept is now public on GitHub, lowering the bar for opportunistic attackers.

This is not Gitea's first brush with active exploitation this year — a separate flaw, CVE-2026-20896, was linked to attacks in early July, though it has not been added to the KEV catalog.

Who Should Act Now

• Any organization self-hosting Gitea between versions 1.17 and 1.27.0, especially instances with open registration enabled
• Federal agencies, who face an August 28, 2026 patch deadline under Binding Operational Directive 22-01
• CI/CD and DevOps teams relying on Gitea as internal source control, where a compromised OS user account can pivot into build pipelines and secrets

Mitigation

1. Upgrade to Gitea 1.27.1 or later immediately — this is the definitive fix for the hook-injection path.
2. Disable open self-registration (Service.DISABLE_REGISTRATION in app.ini) if public sign-up isn't a business requirement — this removes the lowest-friction path to obtaining write access.
3. Audit hook directories (<repo>/.git/hooks/) across hosted repositories for unexpected post-index-change or other hook files not deployed by your own tooling.
4. Review process and network activity on Gitea hosts for unexplained CPU spikes, unfamiliar outbound connections, or unrecognized binaries — hallmarks of the miner payload reported in the wild.
5. Restrict outbound network access from the Gitea host where feasible, to limit the blast radius of any dropped payload reaching out to a C2 or mining pool.

Sources

• The Hacker News — Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
• GitHub — CVE-2026-60004 Proof of Concept
• runZero — Gitea vulnerability CVE-2026-60004: find impacted assets