Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. The code injection vulnerability (CVE-2026-60004) targeted in these attacks was reported by Salesforce security researcher Shai Rod, and it allows authenticated attackers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. While successful exploitation requires repository write access to repositories hosted on vulnerable servers, Gitea comes with self-registration enabled by default, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials. "Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user," Gitea's security team explains. "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository." Gitea released version 1.27.1 on July 27 to address CVE-2026-60004 and advised users to upgrade their servers as soon as possible. On Friday, Internet security watchdog group Shadowserver warned that nearly 8,400 Gitea servers exposed online are still unsecured and...
Over 8,300 Gitea servers vulnerable to code execution attacks
Affected Software
Frequently Asked Questions
Which Gitea deployments are exposed to this vulnerability?
More than 8,300 Internet-exposed Gitea instances remain unpatched, according to Shadowserver. The affected flaw is CVE-2026-60004.
What access does an attacker need to exploit CVE-2026-60004?
Exploitation requires write access to a repository hosted on a vulnerable server. However, because self-registration is enabled by default, an unauthenticated attacker can register an account, create a repository, and obtain the needed access.
What can successful exploitation do?
An attacker can submit a malicious patch through the diffpatch API endpoint to install and execute a Git hook from repository-controlled content. This enables arbitrary shell commands to run with the privileges of the Gitea service account.
Is the vulnerability being exploited?
Yes. The flaw is described as being exploited in ongoing remote code execution attacks and is listed as exploited in the KEV as of August 28, 2026.