Affected Systems

Gitea versions prior to 1.27.1. Over 8,300 Internet-exposed instances remain vulnerable. Affects self-hosted Gitea installations with default open registration enabled. Exploitation requires repository write access, but default configuration allows unauthenticated account creation.

Exploitation Status

Active exploitation confirmed. CISA added CVE-2026-60004 to KEV catalog on August 26, 2026. Attackers deploying cryptocurrency mining malware on compromised servers. Shadowserver Foundation scanning detected 8,393 vulnerable IPs as of August 27, 2026.

Business Impact

Critical RCE vulnerability allows authenticated attackers to execute arbitrary shell commands as the Gitea OS user via malicious patches to the diffpatch API endpoint. Default open registration lowers exploitation barrier—attackers can self-register, create a repository, and trigger the flaw without prior credentials. Federal agencies under BOD 26-04 mandate to patch by August 28. Cryptocurrency miners observed in attacks; potential for lateral movement and data exfiltration in DevOps environments.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade all Gitea instances to version 1.27.1 or later immediately
  • Disable open self-registration in Gitea configuration (app.ini: DISABLE_REGISTRATION = true) if not operationally required
  • Audit existing user accounts and repositories for suspicious registrations or commits since July 2026
  • Monitor Gitea service account process execution for unusual child processes (e.g., curl, wget, crypto miners) via EDR or Sysmon
  • Review network egress from Gitea servers for connections to known mining pools or C2 infrastructure