Over 8,300 Gitea Servers Still Vulnerable to Active Code Execution Attacks

What Happened

Cybersecurity watchdog Shadowserver reports that more than 8,300 internet-exposed Gitea instances remain unpatched against CVE-2026-60004, a critical remote code execution flaw under active, ongoing exploitation. Gitea is a self-hosted Git service with over 400,000 installations worldwide, making the exposed footprint a meaningful supply chain risk.

Shadowserver's tracked exposure count has grown quickly — reports from just days earlier cited roughly 5,000 exposed instances, with no visibility into how many were honeypots or already secured. The figure has since climbed to over 8,300 confirmed-unpatched servers.

The Vulnerability: CVE-2026-60004

The flaw allows an attacker with write access to a repository to execute arbitrary shell commands as the Gitea service account. The barrier to obtaining that write access is low: Gitea ships with self-registration enabled by default, so an unauthenticated visitor can simply register an account, create a repository, and trigger the exploit — no prior credentials needed.

Gitea's security team confirmed the attack path directly: "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository."

Active Exploitation

Security researchers have documented real-world attacks exploiting CVE-2026-60004. In one observed chain, an attacker executed code inside the Gitea container as the git user, first writing a "proof" of RCE back into a Git branch, then downloading a universal shell-loader followed by a crypto-miner-like dropper — which reportedly competed with other malware already present for CPU resources on compromised hosts.

CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to patch by August 28, 2026.

A separate related flaw, CVE-2026-59774, disclosed around the same time, allows unauthenticated attackers to read arbitrary files on vulnerable servers and potentially chain into RCE as well — compounding the risk for organizations still running unpatched Gitea deployments.

Remediation

• Upgrade to Gitea 1.27.1 or later immediately — this is the only fix for CVE-2026-60004.
• Disable self-registration (DISABLE_REGISTRATION = true in app.ini) if open sign-up isn't required for your instance, closing the lowest-effort path to exploitation.
• Restrict internet exposure of self-hosted Gitea instances where possible, placing them behind VPN or authenticated reverse-proxy access.
• Audit for indicators of compromise: unexpected branches or commits containing shell-loader payloads, unusual outbound connections, or unexplained CPU load consistent with cryptomining.
• Check for CVE-2026-59774 exposure as well, given its overlap in timing and affected surface.

Why This Matters

Self-hosted Git platforms sit directly in the software supply chain — a compromised Gitea instance can expose source code, CI/CD secrets, and deployment credentials well beyond the box itself. The combination of a low-barrier exploitation path (default open registration), a critical CVSS score, and confirmed in-the-wild cryptominer deployment makes this a priority patch for any organization running self-hosted Gitea, not just those on the exposed-instance list.

Sources

• BleepingComputer — Hackers now exploit critical Gitea flaw in code injection attacks
• Help Net Security — Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
• The Hacker News — Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload