Full research report

Over 8,300 Gitea servers vulnerable to code execution attacks

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-60004 is a severe and rapidly-weaponised code injection flaw rooted in how Gitea's vulnerable releases used a bare Git clone for patch processing, inadvertently exposing the hooks directory to attacker-controlled patch content. The default open-registration setting eliminates any meaningful access barrier, reducing the effective attack requirement to simple network reachability — a condition met by over 8,300 currently exposed servers. A public proof-of-concept was available within 24 hours of the 2026-07-27 patch, and confirmed exploitation followed within a month. The observed payload is a self-deleting cryptomining dropper, but the underlying primitive — authenticated shell execution as the Gitea service account — enables far more destructive outcomes including supply-chain code injection and CI/CD research process compromise. Threat actor attribution remains unestablished; the opportunistic speed of exploitation (one documented case completed in ~11 seconds) suggests automated scanning rather than targeted intrusion.

What happened

On 2026-07-27, Gitea released version 1.27.1 to patch CVE-2026-60004, a critical (CVSS 9.8) code injection vulnerability in the diffpatch API endpoint reported by Salesforce researcher Shai Rod (NightRang3r). A public proof-of-concept was published the following day. Within a month, exploitation in the wild was confirmed and CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 2026-08-25, ordering US Federal Civilian Executive Branch agencies to patch by 2026-08-28. As of 2026-08-27, Shadowserver identified 8,393 internet-exposed Gitea instances still running vulnerable versions.

Affected scope

Gitea versions 1.17 through 1.27.0 (inclusive). Any internet-accessible self-hosted Gitea instance with default settings is at highest risk, particularly those with open self-registration enabled (the default). Organisations using Gitea for software development, CI/CD pipelines, or as internal code repositories are affected; no specific sector targeting has been attributed.

Technical assessment

The vulnerability (CWE-94) arises from how vulnerable Gitea releases used a bare Git clone for temporary repository processing, causing the repository directory to act as Git's internal data directory. A malicious patch submitted to the diffpatch API endpoint (/api/v1/repos/{owner}/{repo}/diffpatch) can, via Git's three-way patch-processing fallback, materialise an attacker-controlled executable file into the repository's hooks directory. When a subsequent Git operation triggers that hook, arbitrary shell commands execute with the privileges of the Gitea service account. Because Gitea enables open user registration by default, an unauthenticated attacker can register an account, create a repository, and complete the full exploit chain — observed in one documented case in approximately 11 seconds.

Recommended defensive actions

  1. Upgrade all Gitea instances to version 1.27.2 or later immediately; version 1.27.1 is the minimum fix but 1.27.2 is the current stable release.
  2. Audit all internet-exposed Gitea instances for version currency using Shadowserver exposure data or the runZero query: vendor:=Gitea AND product:=Gitea.
  3. Disable open user self-registration (set DISABLE_REGISTRATION=true, REGISTER_EMAIL_CONFIRM=true, ENABLE_OPENID_SIGNUP=false) as an interim control on unpatched instances.
  4. Hunt for evidence of compromise: inspect Git hooks directories under repository storage for unexpected executables, review Gitea service account process lineage for spawned shells, and check for sustained high CPU usage indicative of cryptomining.
  5. Rotate all secrets, tokens, and credentials associated with compromised or suspect Gitea instances, and tighten outbound network access for the Gitea service container or process.
  6. Deploy detection rules targeting repeated POST requests to the diffpatch API endpoint, new account creation followed immediately by repository creation and patch submission, and shells or download utilities launched as child processes of the Gitea service account.

Uncertainties and evidence gaps

  • Specific threat actor identity or group affiliation has not been attributed; exploitation may involve multiple opportunistic actors rather than a single campaign.
  • The payload described (cryptomining dropper) is from one documented victim report; whether other payloads (backdoors, ransomware, supply-chain implants) are being deployed by different actors is unknown.
  • Whether CVE-2026-20896, a separate Gitea vulnerability reportedly exploited in early July 2026, is related to or used in conjunction with CVE-2026-60004 campaigns is unconfirmed.
  • Full global exposure count may differ from the 8,393 figure; Shadowserver scanning covers only internet-accessible hosts and will not reflect internal-only deployments.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork-accessible Gitea instance; attacker requires only repository write access, obtainable via self-registration on default configurations without any prior credentials.
ComponentGitea diffpatch API endpoint (/api/v1/repos/{owner}/{repo}/diffpatch) and the underlying temporary bare-clone Git repository storage directory.
MechanismImproper handling of patch content (CWE-94) allows attacker-supplied data to traverse into the Git hooks directory of a temporary repository during three-way patch processing, creating an executable hook file under Gitea's storage path.
ImpactArbitrary operating-system command execution with the privileges of the Gitea service account; potential for full server compromise, credential theft, CI/CD research process poisoning, and supply-chain code injection.
DetectionExecutable files appearing in Git hooks directories beneath repository storage; shells or interpreters spawned as child processes of the Gitea process; repeated POST requests to the diffpatch endpoint from newly registered accounts; sustained anomalous CPU utilisation on Gitea hosts.
MitigationUpgrade to Gitea 1.27.1 or later (1.27.2 recommended). Interim: disable open user registration and restrict diffpatch endpoint access via reverse-proxy controls.
Exploitation status

Confirmed active exploitation in the wild; CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue on 2026-08-25. Observed attacks deploy a cryptocurrency-mining dropper. A public proof-of-concept has been available since initial disclosure on 2026-07-28.

Research process

The investigation began with a confirmed CISA KEV entry and a Shadowserver exposure figure as the anchoring facts, then used primary reporting and independent technical analysis to establish the full exploit chain, real-world payload behaviour, and the scope of unpatched exposure. Multiple independent sources corroborated active exploitation, the public PoC availability, and the cryptomining payload, raising confidence to high. The principal uncertainty that remains is actor attribution and whether payloads beyond cryptomining are being delivered.

  1. What is CVE-2026-60004, which products does it affect, and what is its severity?
    Searched for 'CVE-2026-60004 Gitea remote code execution vulnerability 2026'.

    CVE-2026-60004 is a CVSS 9.8 code injection flaw in Gitea's diffpatch API affecting versions 1.17–1.27.0, patched in 1.27.1 released 2026-07-27. Reported by Shai Rod of Salesforce.

    why Established the product, severity, affected version range, patch availability, and original researcher — the minimum facts needed to frame the event.

  2. Has CISA confirmed active exploitation, and what are the patch deadlines?
    Searched for 'Gitea CVE-2026-60004 CISA KEV actively exploited 2026'.

    CISA added the flaw to the KEV catalogue on 2026-08-25 and mandated FCEB agencies to patch by 2026-08-28 under BOD 26-04. Exploitation confirmed in the wild.

    why Confirmed authoritative government-level exploitation attestation and the regulatory deadline, which elevates operational urgency beyond a vendor advisory alone.

  3. What are the precise technical mechanics, and how wide is current unpatched exposure?
    Fetched BleepingComputer article: https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/
    bleepingcomputer.com ↗

    Shadowserver identified 8,393 vulnerable internet-exposed instances on 2026-08-27. Gitea's own security team statement confirmed the diffpatch/hook mechanism and the open-registration amplifier.

    why Provided both the precise technical description (from the vendor) and a quantified exposure figure from a credible scanning authority, grounding the scope claim.

  4. What payload behaviour has been observed in the wild, and has a PoC been published?
    Fetched The Hacker News article: https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html
    thehackernews.com ↗

    Documented dropper clears LD_PRELOAD/LD_LIBRARY_PATH, kills competing CPU-heavy processes, downloads an architecture-specific payload, executes it and self-deletes — consistent with cryptomining. Researcher alias NightRang3r confirmed.

    why Moved the payload assessment from inference to a concrete documented behaviour, which is essential for hunting and distinguishing cryptomining from more destructive follow-on activity.

  5. Is there corroboration of the PoC timeline, deeper technical root cause, and detection logic?
    Fetched SOC Prime analysis: https://socprime.com/blog/cve-2026-60004-critical-gitea-rce-exploited-to-deploy-miner-like-payloads/
    socprime.com ↗

    Confirmed public PoC available since 2026-07-28 disclosure. Root cause: bare-clone temporary repository design allows patch content to reach the hooks directory. Detailed detection signals listed including API request patterns and process lineage.

    why Independently corroborated the PoC availability date, provided the CWE-94 root cause, and supplied actionable detection indicators beyond what vendor or CISA advisories offered.

  6. Does a first-hand victim account exist, and what interim mitigations were effective?
    Fetched Help Net Security article: https://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/
    helpnetsecurity.com ↗

    Developer victim report: full exploit chain completed in ~11 seconds after account registration. Post-compromise steps included disabling registration, revoking secrets, tightening network egress. Advisory notes v1.27.2 as current stable.

    why A first-hand victim account anchors the real-world speed of exploitation and validates the open-registration risk factor; the post-compromise hardening steps informed the defensive-actions section.

  7. What structured detection rules and remediation steps do security vendors recommend?
    Fetched Security Arsenal guide: https://securityarsenal.com/blog/cve-2026-60004-gitea-diffpatch-code-injection-added-to-cisa-kev-detection-and-remediation-guide
    securityarsenal.com ↗

    Three Sigma rules (MITRE T1059) covering shell-spawn detection, hook-file creation, and diffpatch API abuse. KQL and VQL variants provided. Eight-step remediation framework aligned to BOD 26-04.

    why Converted the technical findings into concrete, prioritised detection and remediation actions appropriate for defenders and decision-makers.

Named in this story
Actorsunknown threat actor(s) deploying cryptomining dropper
Malwarecryptocurrency-mining dropper (unnamed; architecture-specific, self-deleting)
Targetsself-hosted Gitea instances with open registration enabled; software development organisations; CI/CD research process infrastructure
Related CVEs CVE-2026-60004

Research coverage

All 73 registered source leaves were evaluated for this run: 66 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 62 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 73 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok9 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1685 records Primary evidence2 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The DFIR Reportnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok13 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit 42news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
WeLiveSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Additional verified pages 8 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-60004 CISA KEV Gitea Gitea · added 2026-08-25 CISA catalog ↗
CVE-2026-60004 EPSS 82.4% 100th percentile exploitation probability
Technical references2
github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code1
CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads — SOC Prime socprime.com ↗

Confirms public PoC available since disclosure; describes dropper behaviour and detection logic.

Vendor & gov advisories3
CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-60004) cisa.gov ↗

Primary KEV entry confirming active exploitation; BOD 26-04 deadline of 2026-08-28 for FCEB agencies.

CISA Warns of Exploited Gitea Vulnerability — SecurityWeek securityweek.com ↗

Independent corroboration of KEV addition and patch details; notes a prior exploited Gitea CVE (CVE-2026-20896) for context.

CVE-2026-60004 Detection and Remediation Guide — Security Arsenal securityarsenal.com ↗

Sigma, KQL and VQL detection rules; eight-step remediation aligned with BOD 26-04.

Analysis & research4
Critical Gitea RCE Actively Exploited — The Hacker News thehackernews.com ↗

Documents dropper behaviour: clears LD_PRELOAD/LD_LIBRARY_PATH, kills competing processes, downloads architecture-specific payload, self-deletes.

Critical Gitea vulnerability now exploited in the wild — Help Net Security helpnetsecurity.com ↗

First-hand victim account: attacker registered, created repository and triggered exploit in ~11 seconds; post-compromise hardening steps described.

Gitea vulnerability CVE-2026-60004: find impacted assets — runZero runzero.com ↗

Asset-discovery query and GHSA-rcr6-4jqh-j84m reference; notes supply-chain risk for downstream build pipelines.

Over 8,300 Gitea servers vulnerable to code execution attacks — BleepingComputer bleepingcomputer.com ↗

Primary reporting article; cites Shadowserver scan showing 8,393 vulnerable internet-exposed instances as of 2026-08-27.