CISA on August 26, 2026, added CVE-2026-60004, a critical code injection flaw in Gitea, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. Federal agencies now have until August 28, 2026, to patch the self-hosted Git platform.
What to Know?
- Security researcher Shai Rod discovered the vulnerability, and per Gitea’s advisory, the diffpatch endpoint can be abused to install and run a Git hook built from repository-controlled content.
- Open registration ships on by default, so unauthenticated users can create accounts and repositories to get that write access without an invite.
- The flaw carries a CVSS score of 9.8 and hits every version from 1.17 onward.
- The self-hosted operator’s instance triggered a hosting-provider alert, according to Andrey’s incident report, about CPU usage exceeding 70% capacity, which traced to a cryptomining dropper.
- Gitea’s developers shipped the fix in version 1.27.1 in late July, according to SecurityWeek’s reporting, weeks before the federal patching deadline CISA later set.
How the Diffpatch Bug Turns Signup Into Root Access
The vulnerability’s root cause sits in Gitea’s diffpatch API endpoint, the code path the platform uses to accept and apply patch-format changes to a repository, according to CISA’s own account. The timing fits a wider pattern: SQ Magazine’s own Cybersecurity Attacks Statistics research puts global cyberattacks at nearly 2,000 incidents a week on average. That scanning volume also explains why small, less-staffed operations end up exposed fastest.
SQ Magazine’s Small Business Cybersecurity research finds small firms absorb a disproportionate share of attacks, and they are the same population running most public Gitea instances.
Gitea’s own advisory describes the flaw plainly: the diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. CISA’s KEV entry puts the same mechanism in blunter terms: Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
That “repository write access” clause matters because Gitea ships with open registration switched on by default. Unauthenticated users can create accounts and repositories to obtain the write access the exploit needs. This is an exposure-by-default story: open registration turns “needs repository write access” into “needs a signup form,” not a technical-skill gap.
Configuration Defaults Made the Andrey Attack Possible
According to the incident report, Andrey’s Gitea instance had open registration enabled, email confirmation disabled, OpenID signup permitted, and the sign-in page visible without restriction. Those four settings together turned Gitea’s advertised threat model, an authenticated contributor abusing write access, into an open door.
The dropper itself cleared environment variables, hunted for high-CPU processes, tried to kill competing processes, and pulled down an architecture-specific payload before running and deleting itself. That sequence is consistent with commodity cryptojacking tooling rather than a bespoke campaign.
That four-item list doubles as an audit checklist for any team running a public Gitea instance: confirm registration is invite-only or admin approved, require email confirmation, disable OpenID signup unless it is actively used, and restrict who can view the sign-in page. None of those settings needs a patch. They are configuration choices any admin can flip today.
Implications for Self-Hosted Developer Tools
Gitea now carries a second vulnerability under active exploitation in as many months. CVE-2026-20896 surfaced in early July and has not yet been added to CISA’s KEV catalog, despite that earlier exploitation.
Self-hosted git forges are quietly joining the same attack surface tracked elsewhere in the toolchain. An unpatched, open-registration Gitea box behind a firewall is the same risk wearing a different label.
SQ Magazine’s Takeaway
This bug is dangerous less for what it lets an attacker do and more for how little it takes to get there. Pairing a critical severity flaw with open registration turns a contributor only exploit into one anyone with a browser can attempt. The Andrey report shows what that looks like in practice: a hosting alert, a CPU spike, and a miner running quietly on infrastructure nobody was watching closely enough.
What’s Next: teams running Gitea should update to version 1.27.1 or later now, and treat the federal August 28 deadline as a floor, not a target, since the exploitation CISA confirmed is already public. Admins should also audit the same four settings the Andrey report flagged, registration, email confirmation, OpenID signup, and sign-in page visibility, on every instance they run. Gitea’s exploitation streak this summer justifies a recurring advisory-watch habit instead of a set-and-forget deployment.
