GoKawiil8,300+ Gitea servers remain exposed to actively exploited RCE flaw
Shadowserver reports over 8,300 internet-facing Gitea instances remain unpatched against CVE-2026-60004, a critical code injection bug already being exploited in the wild. The flaw lets an attacker with repository write access run arbitrary shell commands as the Gitea service account, and since Gitea allows open self-registration by default, unauthenticated users can create an account and repository to gain that access. Gitea patched the issue in version 1.27.1 on July 27, and CISA has added it to its known exploited vulnerabilities list, giving federal agencies just three days to remediate.
GoKawiil's interpretation of the reporting above, not reported fact.
Because exploitation doesn't require prior credentials on many default configurations, the attack surface is far larger than typical authenticated RCE bugs, turning any exposed Gitea server into an easy target. With CISA's rapid federal patch deadline and thousands of servers still vulnerable weeks after a fix shipped, this highlights how slowly self-hosted developer tools get patched compared to cloud services, leaving source code and CI pipelines at risk.
- CVE-2026-60004 allows shell command execution via Gitea's diffpatch API endpoint.
- Default open self-registration lets unauthenticated attackers gain the repository access needed to exploit it.
- Despite a patch (v1.27.1) since July 27, over 8,300 servers remain vulnerable as of late August.
Yubico YubiKey 5 NFC Security Key — If you self-host Git services like Gitea, hardening admin logins is step one alongside patching. The YubiKey 5 NFC adds hardware-backed two-factor authentication to your Git server, SSH sessions and cloud accounts, so a stolen password alone won't get anyone repository write access. It works over USB-A and NFC, making it easy to carry between your desktop and phone.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-28
Published there as: “Over 8,300 Gitea servers vulnerable to code execution attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.