Gitea CVE-2026-60004: Critical RCE Exploited for Cryptomining

Rudra Verma, Senior Security Architect & Researcher · 2026-08-31

CVE-2026-60004 is a critical (CVSS 9.8) code-injection vulnerability in the self-hosted Git service Gitea. A user with ordinary write access to any repository can send a crafted patch through the diffpatch API endpoint, plant an executable Git hook, and run arbitrary shell commands as the Gitea service account.

Because Gitea ships with open self-registration enabled by default, attackers can create the account they need without any prior credentials — collapsing the exploit into a near-unauthenticated remote code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 26, 2026 after in-the-wild cryptomining, and Shadowserver counted 8,393 exposed instances two days later.

◈ Table of Contents

01 Background & Affected Versions 02 How the Exploit Works 03 Active Exploitation & Exposure 04 Detection & Hunt Queries 05 Mitigation & Hardening 06 MITRE ATT&CK Mapping 07 Sources & References

🧩

Background & Affected Versions

Phase 01

Gitea is a lightweight, self-hosted Git platform widely deployed inside development teams, CI/CD estates, and homelabs as an alternative to GitHub Enterprise or GitLab. That footprint — often exposed to the internet and rarely centrally patched — is exactly what makes CVE-2026-60004 attractive to opportunistic operators.

The bug is classified as CWE-94 (code injection). The diffpatch API, intended to apply a patch to a repository through the web interface, fails to properly constrain what an authenticated-but-low-privilege user can write. The result is the ability to plant a server-side Git hook, which Gitea executes on the next repository event, yielding shell access as the service account.

Attribute	Value
CVE ID	CVE-2026-60004
CVSS v3.1	9.8 Critical
Weakness	CWE-94 — Code Injection
Affected versions	Gitea 1.17.0 through 1.27.0
Fixed version	Gitea 1.27.1 (released July 27, 2026)
Privilege required	Repository write access (obtainable via open registration)
CISA KEV	Added August 26, 2026 — federal patch deadline August 28, 2026
Credited researcher	Shai Rod (NightRang3r)

NVD assigns a 9.8 base score because default deployments allow self-registration. If your instance disables registration, the flaw still applies to any existing user with write access to a single repository — treat it as critical regardless.

⚙️

How the Exploit Works

Phase 02

The exploit chains a low bar for access with a server-side execution primitive. Git hooks are scripts that Gitea runs automatically on repository events such as pushes; the diffpatch weakness lets an attacker write into that hook path when they should not be able to.

Exploit chain — open registration collapses this into near-unauthenticated RCE

1 Gain a foothold account Access

In default configurations, Gitea permits self-registration with no email confirmation. An attacker signs up, or reuses an existing low-privilege developer account, and obtains write access to at least one repository.

iRegistration keys that matter: DISABLE_REGISTRATION=false, REGISTER_EMAIL_CONFIRM=false, ENABLE_OPENID_SIGNUP=true.

iiAny repository the account can push to is sufficient — a personal repo the attacker creates works.

2 Abuse the diffpatch endpoint Injection

The attacker submits a crafted patch to the diffpatch API. Because the endpoint does not adequately constrain the write path, the patch is used to place an executable Git hook — a script Gitea trusts and runs server-side.

3 Execute as the service account RCE

On the next triggering event, Gitea runs the planted hook, executing arbitrary shell commands with the privileges of the Gitea process. In observed activity this was used to fetch and run a cryptocurrency miner.

Reported miner behaviour

Sustained CPU load above 70% on the host
Clears LD_PRELOAD and LD_LIBRARY_PATH before running
Kills competing high-CPU processes to maximise its own hashrate
Fetches an architecture-specific payload, executes it, then deletes it

No mining pool, wallet address, IP, or file hash was disclosed by the reporting party. Do not treat the behavioural traits above as signatures — hunt on behaviour, not on invented indicators.

🌐

Active Exploitation & Exposure

Phase 03

In-the-wild abuse was surfaced when a developer noticed anomalous CPU consumption on a hosted Gitea instance; the hosting provider HOSTKEY corroborated the anomaly. CISA followed with a KEV listing on August 26, 2026, giving U.S. federal agencies until August 28 to remediate — a compressed three-day window that signals confirmed, ongoing exploitation.

Signal	Detail
Exposed instances	8,393 internet-facing Gitea servers (Shadowserver scan, August 27, 2026)
Observed payload	Cryptocurrency miner dropped via planted Git hook
Patch availability	1.27.1 shipped July 27, 2026 — roughly a month before mass scanning
Regulatory driver	CISA KEV binding operational directive, 3-day federal deadline

📊 Shadowserver — exposed Gitea scan data Daily internet-exposure reporting · shadowserver.org ↗

The one-month gap between patch (Jul 27) and mass exploitation (late Aug) is the recurring pattern for self-hosted dev tooling: teams treat Gitea as infrastructure they forget, not software they patch. Add it to your monthly vulnerability review scope.

🔎

Detection & Hunt Queries

Phase 04

Gitea typically runs on Linux, so the highest-value telemetry comes from host process and file monitoring (auditd, Sysmon for Linux, or EDR) plus the Gitea application logs. Below are starting points for the three most common stacks. Tune paths to your deployment (/var/lib/gitea, /data/git, or your custom root).

Shell — quick triage on the Gitea host

# Look for unexpected executable git hooks outside your known-good set $ find /var/lib/gitea -path '*/hooks/*' -type f -perm -u+x -mtime -30 -ls # Review Gitea version — anything < 1.27.1 is vulnerable $ gitea --version # Check current registration posture in app.ini $ grep -Ei 'DISABLE_REGISTRATION|REGISTER_EMAIL_CONFIRM|ENABLE_OPENID_SIGNUP|REQUIRE_SIGNIN_VIEW' app.ini

DETECTS: child processes spawned by the Gitea binary that indicate hook-based command execution (shells, download utilities).

KQL — Microsoft Sentinel / Defender (Linux via MDE)

// Suspicious children of the gitea process on Linux endpoints DeviceProcessEvents | where InitiatingProcessFileName == "gitea" | where FileName in ("bash","sh","curl","wget","python3","perl") | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName | order by Timestamp desc

SPL — Splunk (Linux auditd / Sysmon for Linux)

# Gitea spawning shells or downloaders + new files under a hooks/ path index=linux (sourcetype=linux:audit OR sourcetype=sysmon:linux) parent_process_name=gitea process_name IN (bash,sh,curl,wget,python3,perl) | stats count min(_time) as first max(_time) as last values(process) as cmd by host,user | sort - last

Splunk — new executable hook files

index=linux sourcetype=linux:audit type=PATH name="*/hooks/*" | search perm="*x*" | stats count values(name) as hook_path by host, _time | sort - _time

The cleanest single indicator is causality: the Gitea service account should almost never be the parent of an interactive shell or a network downloader. Alert on that relationship and you catch the class of attack, not one payload.

🛡️

Mitigation & Hardening

Phase 05

1 Patch to 1.27.1 or later Priority

Upgrading to Gitea 1.27.1+ closes the diffpatch code-injection path. This is the only complete fix; the hardening steps below reduce exposure but do not eliminate the vulnerability for existing write-capable users.

2 Shrink the registration attack surface Config

app.ini — [service] section

DISABLE_REGISTRATION = true REGISTER_EMAIL_CONFIRM = true ENABLE_OPENID_SIGNUP = false REQUIRE_SIGNIN_VIEW = true

Disabling open registration removes the anonymous path to a write-capable account, downgrading a near-unauthenticated exploit to an insider/authenticated one.

3 Contain the blast radius Architecture

1Run Gitea as a dedicated, unprivileged service account with no shell and no sudo rights.

2Place the instance behind a VPN or reverse proxy with authentication; do not expose the web UI directly to the internet unless required.

3Restrict outbound network egress from the Gitea host so a planted hook cannot fetch a second-stage payload.

4After patching, audit existing repositories for unexpected files under any hooks/ directory and review recently created accounts.

If your instance was internet-exposed and unpatched during late August 2026, assume possible compromise: check for the miner CPU signature, unexpected hooks, and unknown user accounts before restoring trust.

🎯

MITRE ATT&CK Mapping

Phase 06

Tactic	Technique	How it appears here
Initial Access	T1190	Exploit Public-Facing Application — the exposed Gitea web service
Execution	T1059	Command & Scripting Interpreter — shell run by the planted hook
Persistence	T1543	Create/Modify System Process — malicious Git hook re-triggers on events
Impact	T1496	Resource Hijacking — cryptocurrency miner consuming host CPU

📚

Sources & References

Phase 07

NVD — CVE-2026-60004 record (CVSS 9.8, CWE-94) CISA — Known Exploited Vulnerabilities Catalog The Hacker News — Critical Gitea RCE actively exploited BleepingComputer — Over 8,300 Gitea servers vulnerable Shadowserver Foundation — internet exposure reporting Gitea — configuration cheat sheet (service/registration keys)

Patch first, then hunt. Run CyberHawk's IOC Scanner against your Gitea hosts, and browse the Threat Intel feed for the latest actively-exploited CVEs in your stack. Self-hosted dev tooling deserves the same patch cadence as your edge appliances.

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram

🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."