Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
CVE-2026-60004 is a critical remote code execution vulnerability (CVSS 9.8) in Gitea affecting all versions from 1.17 onward, patched in version 1.27.1 The flaw allows attackers with repository write access to inject malicious patches via the diffpatch API endpoint, planting executable Git hooks that execute arbitrary shell commands as the Gitea OS user CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active real-world exploitation A confirmed att
Analysis
TL;DR
- CVE-2026-60004 is a critical remote code execution vulnerability (CVSS 9.8) in Gitea affecting all versions from 1.17 onward, patched in version 1.27.1
- The flaw allows attackers with repository write access to inject malicious patches via the diffpatch API endpoint, planting executable Git hooks that execute arbitrary shell commands as the Gitea OS user
- CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active real-world exploitation
- A confirmed attack case shows threat actors leveraging open registration settings to register accounts, create repositories, and deploy a cryptocurrency-miner-like dropper payload
- Federal agencies in the U.S. are required to patch the flaw by August 28, 2026
Why It Matters
This vulnerability is particularly dangerous because Gitea's default configuration allows open registration, meaning unauthenticated attackers can independently gain the write access needed to exploit the flaw without any pre-existing credentials. The active exploitation in the wild and the deployment of cryptojacking payloads demonstrate that this is not a theoretical risk but an immediate threat to organizations running self-hosted Gitea instances, especially those with default or permissive security configurations.
Technical Details
- Vulnerability: CVE-2026-80004, CVSS score 9.8, classified as a code injection / remote code execution flaw in Gitea's diffpatch endpoint
- Attack Vector: An attacker sends a malicious patch to the diffpatch API endpoint, which plants an executable Git hook from repository-controlled content, enabling arbitrary shell command execution as the Gitea service account
- Affected Versions: All Gitea versions from 1.17 through pre-1.27.1; patched in Gitea 1.27.1
- Discovered By: Security researcher Shai rod (aka NightRang3r)
- Exploited Configuration: The real-world attack was enabled by
DISABLE_REGISTRATION = false,REGISTER_EMAIL_CONFIRM = false,ENABLE_OPENID_SIGNUP = true, andREQUIRE_SIGNIN_VIEW = false, allowing unauthenticated users to self-register, create repositories, and obtain write permissions - Payload Behavior: The dropper script clears
LD_PRELOADandLD_LIBRARY_PATH, searches for and kills competing high-CPU processes, fetches an architecture-specific payload, executes it, and deletes the dropped file — consistent with cryptocurrency mining activity - Exploitation Channel: The attack was delivered over HTTPS (not SSH), confirming the vulnerability is accessible via the web API
Industry Insight
- Organizations running self-hosted Gitea instances must immediately upgrade to version 1.27.1 or later; those unable to patch should at minimum disable open registration (
DISABLE_REGISTRATION = true) and require email confirmation (REGISTER_EMAIL_CONFIRM = true) to raise the barrier for exploitation - The default-permissive configuration of many self-hosted Git platforms creates a broad attack surface — security teams should audit not only software versions but also configuration settings that inadvertently expose vulnerabilities to unauthenticated attackers
- The cryptojacking payload observed in the wild suggests that threat actors are prioritizing Gitea exploitation for resource hijacking at scale, indicating this may become a sustained campaign rather than a one-off incident; monitoring for unusual CPU usage on servers hosting Gitea instances is recommended
Disclaimer: The above content is generated by AI and is for reference only.