Attackers are actively exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Like cloud-hosted GitHub or GitLab SaaS (Software as a Service) platforms, Gitea provides a full suite of DevOps tools, but it is designed to be used as a self-hosted software development platform. Tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, this code injection security flaw allows an authenticated user with repository write access to repositories hosted on vulnerable servers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. However, default-configured Gitea instances have self-registration enabled, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials. "Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user," Gitea's security team explains. "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository." Gitea released version 1.27.1 on July 27 to address CVE-2026-60004 and advised users to upgrade their servers as soon as...
Hackers now exploit critical Gitea flaw in code injection attacks
BleepingComputer
·Sergiu Gatlan
·Published Aug 26, 2026
·Updated
Affected Software
1 affected component
Gitea Gitea self-hosted Git service<1.27.1
Frequently Asked Questions
1
Which Gitea deployments are at risk from CVE-2026-60004?
Vulnerable self-hosted Gitea servers are affected. The flaw can be exploited by a user with repository write access, and default-configured instances permit self-registration, allowing an unauthenticated attacker to create an account and repository before triggering it.
2
What access can an attacker obtain through this vulnerability?
An attacker can execute arbitrary shell commands with the privileges of the Gitea service account. The attack abuses the diffpatch API endpoint to install and execute a Git hook from repository-controlled content.
3
Is exploitation of the Gitea flaw confirmed?
Yes. CISA says attackers are actively exploiting the critical-severity vulnerability, and it was added to the Known Exploited Vulnerabilities catalog on August 27, 2026.