Full research report
Hackers now exploit critical Gitea flaw in code injection attacks
Executive assessment
CVE-2026-60004 is a pre-authentication remote code execution flaw in Gitea's diffpatch API, confirmed actively exploited and added to CISA's Known Exploited Vulnerabilities catalogue on 25 August 2026. The vulnerability, present in Gitea versions 1.17 through 1.27.0, allows any visitor to a default-configured instance to register an account and plant an executable Git hook via crafted patches, achieving OS-level command execution in seconds. A working public PoC with a Nuclei template makes exploitation trivially accessible, and a documented real-world incident shows full compromise in under 11 seconds with a cryptomining payload deployed. With approximately 5,000 internet-exposed instances tracked by Shadowserver and a patch available since 27 July, unpatched deployments — particularly those retaining open registration — remain at immediate and practical risk from opportunistic actors.
What happened
On 27 July 2026, Gitea released version 1.27.1 patching CVE-2026-60004, a critical code injection flaw in the platform's diffpatch API endpoint. Because default Gitea configurations permit open self-registration, the vulnerability is effectively pre-authenticated on unmodified deployments. By 25 August 2026, CISA confirmed active exploitation and added the CVE to its Known Exploited Vulnerabilities catalogue, mandating US federal civilian agencies patch by 28 August. Observed attacks deployed cryptocurrency mining payloads on unpatched servers, with one documented incident completing full compromise in under 11 seconds.
Affected scope
All Gitea versions 1.17 through 1.27.0; self-hosted deployments across all sectors and organisation sizes; approximately 5,000 internet-exposed instances identified by Shadowserver as of August 2026, with the exact number of unpatched instances unknown.
Technical assessment
The flaw resides in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, which applies user-supplied patches inside a temporary Git repository. Crafting a patch to trigger an add/add collision allows attacker-controlled content to be installed as an executable Git hook (post-index-change), which then executes with the privileges of the Gitea OS service account. Because Gitea enables open registration by default, the effective access requirement on a standard deployment is an HTTP connection — no prior credentials are needed. A working PoC with a Nuclei detection template is publicly available, making exploitation accessible to low-skilled actors.
Recommended defensive actions
- Upgrade Gitea to version 1.27.2 or later immediately; version 1.27.1 is the minimum acceptable patch level
- Disable open user registration in the Gitea administration panel if immediate upgrade cannot be applied, to raise the effective access barrier
- Audit all processes and scheduled tasks running under the Gitea service account for signs of unauthorised activity
- Review API access logs for anomalous or high-volume requests to the diffpatch endpoint, particularly from newly registered accounts
- Scan internet-facing Gitea instances using network inventory tooling to confirm patch status and exposure
Uncertainties and evidence gaps
- The identity and attribution of the threat actor(s) responsible for the cryptomining campaign are unknown; no named group or tracked actor has been publicly associated with these attacks
- Shadowserver's count of ~5,000 exposed Gitea instances does not distinguish between patched, unpatched, and honeypot deployments, so the true vulnerable population is unknown
- Researcher attribution is inconsistent: BleepingComputer credits Shai Rod of Salesforce as the discoverer, while the official Gitea release advisory credits @NightRang3r — whether these are the same individual or represent independent discovery is unresolved
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in the wild; CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue on 25 August 2026; a working public pre-authentication proof-of-concept is available.
Investigation began with the BleepingComputer article and CISA KEV entry as primary leads, establishing the event and core technical claims. The official Gitea release blog confirmed the CVE and fix, and surfaced a researcher attribution discrepancy not present in the secondary press. A public PoC on GitHub was verified as a working pre-authentication exploit, confirming the exploitation barrier is very low. HelpNetSecurity and SecurityWeek provided independent corroboration with incident-level evidence of real-world cryptomining attacks, supporting a high-confidence assessment.
- What does the primary source report about CVE-2026-60004?Fetched BleepingComputer articlebleepingcomputer.com ↗
Confirmed CVE-2026-60004, diffpatch mechanism, CISA KEV addition on 25 August 2026, ~5,000 Shadowserver-tracked exposed instances, cryptomining payload in observed attacks, and FCEB patch deadline of 28 August
why Established the factual baseline and confirmed CISA KEV addition, framing the story as confirmed active exploitation
- What do independent searches reveal about scope and corroborating coverage?Web search for CVE-2026-60004 Gitea 2026
Multiple independent outlets — SecurityWeek, HelpNetSecurity, SOC Prime, The Hacker News — cover the story with consistent technical detail; search also surfaced the GitHub PoC and official Gitea release blog
why Confirmed broad independent coverage and identified key additional sources for direct verification
- What does the official Gitea vendor advisory confirm?Fetched Gitea release blog for version 1.27.1blog.gitea.com ↗
Confirmed CVE-2026-60004 fixed by PRs #38637/#38638; reporter listed as @NightRang3r, not Shai Rod as stated by BleepingComputer; a second CVE (CVE-2026-59774, unauthenticated file read) was also fixed in this release
why Official vendor source confirms the patch and mechanism; the researcher attribution discrepancy is a material inconsistency warranting flagging
- Is a public proof-of-concept exploit available, and how accessible is exploitation?Fetched GitHub PoC repositorygithub.com ↗
Verified working pre-auth PoC covering full exploit chain from account registration to Git hook injection; includes a Nuclei template; confirmed to affect Gitea 1.17 through 1.27.0
why Confirms exploitation barrier is very low; widely accessible tooling makes this a mass-exploitation risk, not just a targeted one
- What incident-level evidence of real-world exploitation exists?Fetched HelpNetSecurity articlehelpnetsecurity.com ↗
Documents a real incident: attacker registered account, triggered exploit chain, and deployed cryptomining malware in under 11 seconds; malware did not persist after container restart; incident originally reported on Habr
why Provides concrete incident evidence elevating exploitation status from claimed to confirmed; the 11-second timeline underlines the urgency of patching
- Does SecurityWeek independently corroborate active exploitation and CISA's response?Fetched SecurityWeek articlesecurityweek.com ↗
Independently confirmed active exploitation, CISA KEV addition, and August 28 federal patch mandate; noted related CVE-2026-20896 (authentication bypass) was exploited in July 2026 but not yet in KEV at time of writing
why Second independent domain corroborating exploitation and CISA action, satisfying the minimum independent-source requirement for high confidence
Research coverage
All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (2 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok10 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| CISA KEVkev | ok1682 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5333 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1591 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 4 opened outside the registered collection
Vulnerability & exploitation1
Reporting-linked PoC claims1
Linked by reporting but not validated as PoC by the configured exploit indexes.
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Verified working pre-auth PoC covering full exploit chain from account registration to Git hook injection, includes Nuclei template
Vendor & gov advisories1
Official vendor release confirming CVE-2026-60004 fixed via PRs #38637/#38638; recommends immediate upgrade
Analysis & research3
Documents a real incident: exploitation completed in under 11 seconds with cryptomining payload; references original Habr incident report
Independent corroboration of active exploitation, CISA KEV addition, and related CVE-2026-20896 context
Primary reporting; includes Shadowserver ~5,000 exposed-instance count and cryptomining attack detail