Affected Systems

Gitea self-hosted Git service versions prior to 1.27.1. Approximately 5,000 instances exposed online. Default configurations with self-registration enabled are exploitable by unauthenticated attackers.

Exploitation Status

Active exploitation confirmed. CISA added CVE-2026-60004 to KEV catalog. Attackers deploying cryptocurrency mining malware on unpatched servers. Exploitation requires authenticated write access, but default open registration allows unauthenticated attackers to register and exploit.

Business Impact

Critical remote code execution via diffpatch API endpoint allows arbitrary shell command execution as Gitea OS user. Default configurations permit unauthenticated exploitation through self-registration. Threat actors deploying cryptominers; potential for supply chain compromise via code repository access. Federal agencies under 3-day patch mandate (BOD 26-04). Approximately 5,000 internet-exposed instances at risk.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade all Gitea instances to version 1.27.1 or later immediately
  • Disable self-registration on Gitea instances if not required (set DISABLE_REGISTRATION = true in app.ini)
  • Audit existing user accounts and repositories for suspicious activity, particularly newly created accounts with repository write access
  • Monitor Gitea service account processes for unexpected child processes or network connections indicative of cryptominer activity
  • Review Git hooks in all repositories for unauthorized modifications via diffpatch endpoint abuse