8,300 Gitea servers still exposed to a code injection bug attackers are already using
A flaw in Gitea's diffpatch endpoint lets low-privilege users run shell commands on the server. CISA gave federal agencies three days to patch. Most operators haven't.
Key points
- Shadowserver counted 8,393 internet-exposed Gitea servers still vulnerable to CVE-2026-60004 on August 27, 2026.
- The bug lets a user with write access to any repository run shell commands as the Gitea service account.
- Because Gitea ships with open sign-ups on by default, an attacker can register an account and exploit the server without existing credentials.
- Gitea fixed it in version 1.27.1 on July 27.
- CISA added the flaw to its Known Exploited Vulnerabilities list and told federal agencies to patch by August 28.
Gitea is self-hosted software for storing and reviewing source code, the sort of thing companies run in-house instead of paying for GitHub or GitLab. A bug in it, tracked as CVE-2026-60004, lets an attacker take over the server by uploading a booby-trapped code patch. We first covered the flaw on 29 July in "Gitea Patches Critical Flaw That Lets Repo Users Run Shell Commands", when the fix landed. The patch has been out for a month. Thousands of servers still run the old code.
What does the flaw actually let attackers do?
It lets them run any command they want on the server, as the account Gitea itself runs under. That's enough to steal source code, plant backdoors, or install cryptocurrency mining software, which is what's already been seen in the wild.
The bug lives in an internal feature called the diffpatch endpoint, which accepts code changes. Salesforce security researcher Shai Rod found that a malicious patch can trick Gitea into installing and running a Git hook, a small script that Git executes automatically. Once that hook runs, the attacker has a shell on the box.
Gitea's own security team put it plainly: "An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user."
Doesn't the attacker need an account first?
Technically yes, but Gitea ships with self-registration turned on. Anyone who can reach the login page can create an account, spin up a repository, and immediately have the write access the exploit needs. No password guessing, no phishing, no insider required.
Administrators who left the default settings alone are effectively running an open door.
Who is exploiting this?
CISA hasn't named a group, but the agency added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on Tuesday and gave federal civilian agencies until August 28 to patch, a three-day deadline under Binding Operational Directive 26-04. Reports first flagged by BleepingComputer point to attackers installing crypto-mining malware on unpatched servers. That's usually the low-effort end of exploitation. More targeted intrusions are likely happening quietly alongside.
This is the second serious Gitea bug this summer. In July, attackers abused CVE-2026-20896, an authentication bypass in the official Gitea Docker image affecting instances that used reverse proxy authentication headers.
The numbers
| Item | Detail |
|---|---|
| CVE | CVE-2026-60004 (code injection) |
| Fixed version | Gitea 1.27.1 |
| Patch released | July 27, 2026 |
| Vulnerable servers online | 8,393 (Shadowserver, August 27) |
| CISA patch deadline (federal) | August 28, 2026 |
| Reported by | Shai Rod, Salesforce |
What should Gitea operators do right now?
Upgrade to 1.27.1 today. If you can't patch immediately, turn off self-registration in the admin panel and audit any accounts created in the last month.
Gitea has more than 400,000 installations worldwide. Most are run by small teams without a dedicated security engineer. The real concern here isn't the crypto miners: it's whoever comes next, using the same access to quietly copy repositories and disappear. If that describes your setup, treat this patch as urgent, not routine.
