A critical vulnerability in the widely used open source software development platform Gitea has been exploited in the wild by attackers. According to a warning issued by the US Cybersecurity and Infrastructure Security Agency (CISA), organizations that haven’t patched the flaw are at risk of remote code execution attacks.
Gitea, which provides Git hosting, code review, team collaboration, and continuous integration/continuous deployment (CI/CD) capabilities, is a popular choice among developers. However, its open source nature means that vulnerabilities can be exploited by attackers if not properly addressed. In this case, the exploited vulnerability, tracked as CVE-2026-60004, was patched by Gitea developers in late July with the release of version 1.27.1.
CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and instructed federal agencies to patch it by August 28. The agency warns that an attacker with repository write access can send a malicious patch to the diffpatch API endpoint, allowing them to plant an executable Git hook and run shell commands as the Gitea service account.
This is not the first time a Gitea vulnerability has been exploited in the wild. In early July, organizations were warned about the exploitation of another flaw, CVE-2026-20896. However, it’s worth noting that this latter vulnerability has yet to be added to CISA’s KEV catalog. The lack of previous reports on the exploitation of CVE-2026-60004 suggests that attackers may have only recently discovered the vulnerability or are actively exploiting it.
The exploitation of these vulnerabilities highlights the importance of timely patching and regular security updates for open source software. As Gitea is a self-hosted platform, its security depends heavily on the users who install and configure it. With more than 30,000 deployments exposed to potential attacks due to this vulnerability alone, organizations must take immediate action to prevent exploitation.
The attackers behind these incidents remain unknown, but their goal is likely to gain unauthorized access to sensitive data or disrupt operations. In either case, the consequences can be severe, especially for organizations that handle critical infrastructure, financial information, or sensitive intellectual property.
To protect against this vulnerability, we recommend that Gitea users update to version 1.27.1 immediately and ensure that their installations are secure and properly configured. This includes regularly monitoring logs for suspicious activity and implementing robust access controls to prevent unauthorized access to sensitive areas of the platform. By taking proactive measures, organizations can mitigate the risk of exploitation and maintain the integrity of their software development workflows.
Source: SecurityWeek — 2026-08-26