A critical security vulnerability is being actively exploited by hackers to inject malicious code into self-hosted Git services, putting thousands of organizations at risk. The vulnerability, tracked as CVE-2026-60004, affects Gitea, a popular open-source platform for developers to host and manage their own Git repositories.
Gitea provides a suite of DevOps tools similar to cloud-based platforms like GitHub or GitLab, but it is designed to be used on-premises. However, its default configuration allows unauthenticated users to register an account, create a new repository, and gain the necessary permissions to exploit the vulnerability without prior credentials. An attacker with write access to a repository can submit malicious patches via the diffpatch API endpoint, allowing them to execute arbitrary shell commands with the privileges of the Gitea service account.
The attack is made possible by a code injection flaw in Gitea’s diffpatch endpoint, which can be used to install and execute Git hooks from repository-controlled content. The vulnerability was reported by Salesforce security researcher Shai Rod and has been patched in version 1.27.1 of Gitea, released on July 27. However, with nearly 5,000 Gitea instances exposed online, as tracked by the Shadowserver watchdog, it is likely that many organizations have not yet applied the necessary patches.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-60004 to its KEV catalog and ordered US Federal Civilian Executive Branch agencies to secure their servers within three days. While the agency didn’t share further details on the attacks, it warned that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
This latest development highlights the importance of prioritizing patching and remediation of known vulnerabilities. As CISA encourages all organizations to adopt risk-based vulnerability management, it’s essential to recognize that once attackers have valid credentials, prevention scores can drop sharply. Organizations should take immediate action to upgrade their Gitea servers to version 1.27.1 or later and ensure that default-configured instances are properly secured.
In conclusion, the exploitation of CVE-2026-60004 serves as a stark reminder of the importance of staying vigilant in the face of emerging threats. As cybersecurity professionals, it’s crucial to prioritize patching and remediation, and to stay informed about the latest vulnerabilities and attack vectors. By doing so, we can better protect our systems and networks from the ever-evolving landscape of cyber threats.
Source: Bleeping Computer — 2026-08-26