GoKawiilCISA confirms active exploitation of Gitea code injection bug CVE-2026-60004
CISA has added a critical Gitea vulnerability to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, found in the diffpatch API endpoint, lets someone with repository write access run shell commands as the Gitea service account, and since many installations allow open self-registration, even unauthenticated attackers can gain that access simply by signing up and creating a repository. Gitea patched the issue in version 1.27.1 released July 27.
GoKawiil's interpretation of the reporting above, not reported fact.
Nearly 5,000 Gitea instances are exposed online, and self-hosted Git platforms often sit at the center of internal development pipelines, making them high-value targets for supply-chain style attacks. CISA's three-day patch mandate for federal agencies signals the severity of the risk, especially given how easily default configurations let outsiders exploit the flaw without prior credentials.
- CVE-2026-60004 lets attackers execute arbitrary shell commands via Gitea's diffpatch endpoint.
- Default open registration means unauthenticated users can exploit the bug by simply creating an account and repo.
- Federal agencies must patch within three days; all Gitea admins should upgrade to version 1.27.1 immediately.
YubiKey 5 NFC Security Key — If you self-host Gitea or any dev platform, hardware-backed two-factor auth is one of the simplest ways to keep unwanted accounts out of your infrastructure. The YubiKey 5 NFC plugs into USB-A or taps via NFC and works with major identity providers and Git platforms. It's a tiny, tough key that makes credential-based attacks far less appealing.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-26
Published there as: “Hackers now exploit critical Gitea flaw in code injection attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.