8,300 Gitea servers still exposed to a code injection bug attackers are already using
A flaw in Gitea's diffpatch endpoint lets low-privilege users run shell commands on the server. CISA gave federal agencies three days to patch. Most operators haven't.
Key points
- Shadowserver counted 8,393 internet-exposed Gitea servers still vulnerable to CVE-2026-60004 on August 27, 2026.
- The bug lets a user with write access to any repository run shell commands as the Gitea service account.
- Because Gitea ships with open sign-ups on by default, an attacker can register, create a repo, and exploit the server without credentials.
- Gitea fixed it in version 1.27.1 on July 27.
- CISA added the flaw to its Known Exploited Vulnerabilities list and told federal agencies to patch by August 28.
Gitea is self-hosted software for storing and reviewing source code, the sort of thing companies run in-house instead of paying for GitHub or GitLab. A newly disclosed bug in it, tracked as CVE-2026-60004, lets an attacker take over the server by uploading a booby-trapped code patch.
The fix has been out for a month. Thousands of servers still run the old code.
What does the flaw actually let attackers do?
It lets them run any command they want on the server, as the account Gitea itself runs under. That is enough to steal source code, plant backdoors, or, as has already been seen in the wild, install cryptocurrency mining software.
The bug lives in an internal feature called the diffpatch endpoint, which accepts changes to code. Salesforce security researcher Shai Rod found that a malicious patch can trick Gitea into installing and running a Git hook, a small script that Git executes automatically. Once that hook runs, the attacker has a shell on the box.
Gitea's own security team put it plainly: "An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user."
Doesn't the attacker need an account first?
Technically yes, but Gitea ships with self-registration turned on. Anyone on the internet who can reach the login page can create an account, spin up a new repository, and immediately have the write access the exploit needs. No password guessing, no phishing, no insider required.
Administrators who left the default settings alone are effectively running an open door.
Who is exploiting this?
CISA has not named a group, but the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on Tuesday and gave federal civilian agencies until August 28 to patch, a three-day deadline under Binding Operational Directive 26-04. Reports (first flagged by BleepingComputer) point to attackers installing crypto-mining malware on unpatched servers, which is usually the low-effort end of exploitation. More targeted intrusions are likely happening quietly alongside.
This is the second serious Gitea bug this summer. In July, attackers abused CVE-2026-20896, an authentication bypass in the official Gitea Docker image affecting instances that used reverse proxy authentication headers.
The numbers
| Item | Detail |
|---|---|
| CVE | CVE-2026-60004 (code injection) |
| Fixed version | Gitea 1.27.1 |
| Patch released | July 27, 2026 |
| Vulnerable servers online | 8,393 (Shadowserver, August 27) |
| CISA patch deadline (federal) | August 28, 2026 |
| Reported by | Shai Rod, Salesforce |
What should Gitea operators do right now?
Upgrade to 1.27.1 today. If you cannot patch immediately, turn off self-registration in the admin panel so strangers cannot create accounts, and audit any accounts that were created in the last month.
Gitea has more than 400,000 installations worldwide. Most are run by small teams without a dedicated security engineer. If that describes your setup, assume the server is a target and treat the patch as urgent, not routine.
