Over 8,300 Gitea servers remain vulnerable to code execution attacks, with nearly a third still unpatched against a critical security flaw that allows attackers to execute arbitrary shell commands with elevated privileges. This vulnerability, reported by Salesforce researcher Shai Rod and tracked as CVE-2026-60004, can be exploited even by unauthenticated visitors who register an account and create a new repository on the vulnerable server.
Gitea is a self-hosted code hosting platform that allows developers to host their own repositories, similar to GitHub, GitLab, or Bitbucket. With over 400,000 installations and nearly 1,500 contributors, it’s no surprise that many organizations rely on Gitea for their development needs. However, the default open registration feature of Gitea makes it vulnerable to attacks, as attackers can register an account, create a repository, and trigger the vulnerability without prior credentials.
The CVE-2026-60004 vulnerability allows attackers with write access to repositories to execute arbitrary shell commands with the privileges of the Gitea service account. This is achieved through the diffpatch API endpoint, which can be abused to install and execute Git hooks from repository-controlled content. In other words, once an attacker gains write access to a repository, they can essentially run any command on the server, using the elevated privileges of the Gitea service account.
Despite Gitea releasing version 1.27.1 in July to address this vulnerability, nearly 8,400 servers remain exposed online and vulnerable to ongoing attacks. Shadowserver, an internet security watchdog group, has been scanning and reporting vulnerable instances, highlighting the severity of the situation. The US Cybersecurity and Infrastructure Security Agency (CISA) has also added this vulnerability to its catalog of actively exploited flaws, warning that it poses significant risks to federal agencies.
The ongoing exploitation of CVE-2026-60004 is particularly concerning, as attackers are deploying cryptocurrency mining malware on unpatched Gitea servers. This type of attack can lead to a significant strain on server resources and potentially compromise sensitive data. It’s essential for organizations using Gitea to take immediate action to patch their servers and ensure they have the latest version installed.
For those who haven’t yet patched their servers, it’s crucial to do so as soon as possible. If you’re using Gitea, check your version number and upgrade to 1.27.1 or later immediately. Additionally, review your server’s configuration to ensure that default open registration is disabled. This will prevent attackers from registering an account and creating a new repository without prior credentials.
As the threat landscape continues to evolve, it’s essential for organizations to prioritize patching and updates, especially when vulnerabilities are actively being exploited in the wild. By staying on top of security patches and configurations, you can significantly reduce your organization’s risk exposure and prevent costly attacks like those seen with CVE-2026-60004.
Source: Bleeping Computer — 2026-08-28