Answer Brief
CISA warns of active exploitation of CVE-2026-60004 (CVSS 9.8) in Gitea, allowing repository write access to execute arbitrary commands via the diffpatch endpoint. Attackers leverage default open registration to gain access and deploy miner-like payloads, with U.S. federal agencies required to patch by August 28, 2026.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CISA warns of active exploitation of CVE-2026-60004 in Gitea
- 2
Deadline for U.S. federal agencies to patch CVE-2026-60004
- 3
Analysis confirms attack vector via HTTPS with open registration enabled
- 4
Researcher Andrey (@Causelof) reports cryptojacking attempt on personal Gitea instance
Executive Summary: CISA warns of active exploitation of CVE-2026-60004 (CVSS 9.8) in Gitea, allowing repository write access to execute arbitrary commands via the diffpatch endpoint. Attackers leverage default open registration to gain access and deploy miner-like payloads, with U.S. federal agencies required to patch by August 28, 2026.
Why It Matters
The active exploitation of CVE-2026-60004 in Gitea represents a significant supply chain and DevOps security risk due to the widespread use of Gitea in private and public code hosting environments. The vulnerability’s criticality stems from a combination of a high-severity code injection flaw and insecure default configurations that collectively enable unauthenticated remote code execution. Specifically, the diffpatch endpoint allows repository write access to trigger arbitrary command execution via malicious Git hooks, a vector that becomes exploitable when Gitea permits open registration without email verification or sign-in requirements. This chain—registration, repository creation, and exploit triggering—allows attackers to gain initial access without credentials, posing a severe threat to exposed instances. Technical analysis from the Habr-based researcher Andrey (@Causelof) reveals a multi-stage attack pattern consistent with cryptojacking operations. After gaining write access, the attacker’s dropper script performs environmental checks: clearing LD_PRELOAD and LD_LIBRARY_PATH to evade detection, scanning for high-CPU processes, attempting to terminate competing miners, fetching architecture-specific payloads, writing them to disk, executing them, and cleaning up afterward. The observed spike in CPU usage exceeding 70% on a virtual server, leading to provider-enforced throttling by HOSTKEY, strongly suggests deployment of a cryptocurrency miner, though the exact payload remains unanalyzed. This behavior aligns with known cryptojacking TTPs aimed at maximizing resource hijacking while avoiding detection. The vulnerability affects all Gitea versions from 1.17 onward, with patching introduced in version 1.27.1. Given that many organizations may delay updates or run outdated instances for compatibility reasons, the attack surface remains substantial. The fact that the exploit works over HTTPS and does not require SSH exposure broadens the risk to internet-facing Gitea deployments, particularly those used for internal DevOps workflows or public-facing code collaboration. Organizations relying on Gitea for CI/CD triggers, webhook processing, or internal Git management are especially vulnerable if registration is left open. CISA’s inclusion of CVE-2026-60004 in the KEV catalog underscores its assessment of active exploitation in the wild, though the agency did not attribute the attacks to specific threat actors or confirm targeting of U.S. federal systems. Nevertheless, the binding directive requiring federal agencies to patch by August 28, 2026, reflects urgency driven by observed exploitation patterns. This timeline creates a narrow window for remediation, especially for large organizations with complex patching pipelines. The risk-based prioritization guidance implies that internet-exposed instances should be treated as highest priority. From an operational standpoint, security teams must treat this not only as a patching issue but as a configuration hygiene failure. The reliance on default settings that weaken authentication controls highlights a recurring theme in open-source software risk: security is often compromised not by complex zero-days, but by the combination of modest vulnerabilities and permissive deployments. Teams should audit Gitea instances for registration policies, enforce least-privilege access, and monitor for anomalous process execution or resource consumption as compensatory controls. Globally, the incident serves as a reminder that DevOps tooling security is integral to overall infrastructure resilience. As Gitea is widely used across Asia, Europe, and the Americas for both internal and public code hosting, the exploitation pattern observed here could be replicated in any region where instances are misconfigured.
Event Type: security
Importance: high
Affected Companies
- CISA
- Gitea
- HOSTKEY
Affected Sectors
- Application Security
- Cloud Infrastructure
- DevOps
- Open Source
Key Numbers
- CVSS Score: 9.8
- Affected Gitea Versions: 1.17 and earlier
- Patched Version: 1.27.1
- CPU Usage Observed: >70%
- Patch Deadline for U.S. Federal Agencies: August 28, 2026
Timeline
- CISA warns of active exploitation of CVE-2026-60004 in Gitea
- Deadline for U.S. federal agencies to patch CVE-2026-60004
- Analysis confirms attack vector via HTTPS with open registration enabled
- Researcher Andrey (@Causelof) reports cryptojacking attempt on personal Gitea instance
- Gitea releases advisory on diffpatch endpoint abuse (exact date not specified)
Frequently Asked Questions
What is CVE-2026-60004 and why is it critical?
CVE-2026-60004 is a remote code execution vulnerability in Gitea with a CVSS score of 9.8. It allows attackers with repository write access to execute arbitrary shell commands via the diffpatch API endpoint by planting malicious Git hooks. The flaw is critical because default open registration enables unauthenticated users to gain write access by creating an account and repository.
How are attackers exploiting CVE-2026-60004 in the wild?
Attackers are exploiting CVE-2026-60004 by registering accounts on Gitea instances with open registration enabled, creating repositories, and using the diffpatch endpoint to deploy miner-like payloads. Observed behavior includes clearing LD_PRELOAD, killing competing processes, downloading architecture-specific binaries, and executing them—consistent with cryptojacking campaigns.
What configuration settings increase the risk of exploitation?
The following Gitea configuration settings increase exploitation risk: DISABLE_REGISTRATION = false, REGISTER_EMAIL_CONFIRM = false, ENABLE_OPENID_SIGNUP = true, and REQUIRE_SIGNIN_VIEW = false. These settings allow unauthenticated OpenID-based registration without email confirmation or sign-in requirements, enabling attackers to gain repository write access.
What actions should organizations take to mitigate this vulnerability?
Organizations should immediately update Gitea to version 1.27.1 or later, disable public registration unless required, enforce email confirmation for registrations, restrict OpenID sign-up if not needed, and require sign-in for repository access. Additionally, monitor for unusual CPU usage and review Gitea instance configurations for excessive permissions.
Is there evidence linking this exploitation to U.S. federal systems?
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog and has issued a binding directive requiring U.S. federal agencies to patch by August 28, 2026. While CISA did not confirm exploitation of federal systems, the KEV inclusion and patch mandate indicate active exploitation in the wild, prompting urgent remediation across government networks.