Over 8,300 Gitea servers remain vulnerable to code execution attacks despite a critical security fix being available since July. Cybersecurity watchdog Shadowserver has identified nearly 8,400 Internet-exposed Gitea instances that are still unpatched against a serious flaw exploited in ongoing remote code execution attacks.
The vulnerability, known as CVE-2026-60004, was reported by Salesforce researcher Shai Rod and allows attackers to execute arbitrary shell commands with the privileges of the Gitea service account. To exploit this weakness, an attacker needs only repository write access to repositories hosted on vulnerable servers. However, self-registration is enabled by default in Gitea, allowing unauthenticated users to register an account, create a new repository, and trigger the vulnerability without prior credentials.
Gitea’s security team has explained that its diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. This means that even with default open registration enabled, an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. This vulnerability is particularly concerning because it allows attackers to take control of a server and deploy malicious code.
Gitea released version 1.27.1 in July to address CVE-2026-60004, but despite this critical security fix being available for over a month now, thousands of servers remain unpatched. Shadowserver has warned that these vulnerable instances are still exposed online and remain susceptible to ongoing attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added the vulnerability to its catalog of actively exploited flaws, ordering U.S. Federal Civilian Executive Branch agencies to patch their servers within three days.
The exploitation of this weakness is likely linked to reports of in-the-wild exploitation, where attackers are deploying cryptocurrency mining malware on unpatched Gitea servers. This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise, as CISA has warned.
Gitea is a popular self-hosted alternative to cloud-hosted GitHub, GitLab, and Bitbucket code hosting and DevOps platforms, with over 400,000 installations and nearly 1,500 contributors. It’s essential for administrators and users of Gitea servers to take immediate action and patch their instances as soon as possible to prevent exploitation.
The takeaway from this story is that despite the availability of patches for critical security flaws, many organizations fail to apply them in a timely manner. This highlights the importance of regular monitoring and maintenance of systems, particularly those with high exposure on the internet. Users of Gitea servers should prioritize patching their instances as soon as possible to prevent exploitation by malicious actors.
Source: Bleeping Computer — 2026-08-28