CISA: Hackers Are Actively Exploiting a Patched Gitea Flaw That Lets Them Run Malicious Commands
A security hole in Gitea, a widely used code-hosting platform, is being exploited in the wild. A patch has existed since late July, but federal agencies have until August 28 to apply it.
Key points
- CVE-2026-60004, a remote code execution flaw in Gitea, is being actively exploited, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed.
- Gitea released a fix in version 1.27.1 in late July 2026; unpatched installations remain at risk.
- CISA ordered all U.S. federal agencies to apply the patch by August 28, 2026.
- A second Gitea vulnerability, CVE-2026-20896, was flagged as exploited in early July and has not yet been added to CISA's official warning list.
- Who is behind the attacks and what they are after remains unknown.
Gitea is software that lets companies run their own private version of a code-hosting service, similar to GitHub but installed on a company's own servers. Thousands of development teams use it to store source code, review changes, and automate software builds. That makes it a high-value target: break in, and you may reach the software a company ships to its own customers.
What does this vulnerability actually do?
The flaw lets an attacker who already has write access to at least one code repository plant a hidden instruction file inside the platform and use it to run arbitrary commands on the server. CISA's description is blunt: an attacker can send a specially crafted change request to Gitea's internal file-comparison tool, slip in an executable script called a Git hook (a small program that runs automatically when certain actions happen in a repository), and from there execute commands as the Gitea service account, meaning with the same system permissions the Gitea software itself holds.
In plain terms: if a criminal or a rogue insider has even limited access to one project on your Gitea instance, this bug can let them take over the whole server.
The flaw is tracked as CVE-2026-60004 and was fixed in Gitea version 1.27.1, released in late July.
Should organisations running Gitea be worried?
Yes, if they have not yet updated. Active exploitation is confirmed, and no public reporting had flagged attacks before CISA's warning, which suggests whoever is running the campaign is not broadcasting their methods.
The identity and motive of the attackers are not yet known. That uncertainty cuts both ways: this could be targeted espionage against specific software supply chains, or opportunistic scanning for any exposed instance. Either way, an unpatched server is a live risk.
A second, separate Gitea vulnerability, CVE-2026-20896, was reported as exploited in early July. CISA has not yet added that one to its formal catalogue, first reported by SecurityWeek, but its existence means Gitea has faced back-to-back exploitation in the space of weeks.
| Detail | CVE-2026-60004 | CVE-2026-20896 |
|---|---|---|
| Reported exploited | August 2026 | July 2026 |
| CISA KEV listed | Yes | No |
| Fixed in version | 1.27.1 | Not confirmed |
| Federal patch deadline | August 28, 2026 | None set |
What should your organisation do right now?
Update Gitea to version 1.27.1 or later immediately. Check access logs for unusual activity on your repositories, particularly any automated actions that were not triggered by known users. Audit who holds write access to your projects and remove accounts that no longer need it.
If your Gitea instance is exposed to the public internet, consider placing it behind a private network or a VPN (a virtual private network, which restricts who can even reach the server) while you investigate.
