Gitea CVE-2026-60004 CVSS 9.8 Actively Exploited — Crypto Miner Deployed via diffpatch Code Injection — CISA Deadline August 28

Summary

CISA added CVE-2026-60004, a critical code injection vulnerability in the Gitea self-hosted Git service, to its Known Exploited Vulnerabilities catalog on August 25, 2026, setting a federal remediation deadline of August 28. CVE-2026-60004 carries a CVSS score of 9.8 and allows an attacker with repository write access to execute arbitrary shell commands as the Gitea OS user by sending a malicious patch to the diffpatch API endpoint. The endpoint processes patch data without sufficient sanitization, allowing injection of executable Git hook content. A developer on the Russian collaborative platform Habr published an incident report describing confirmed exploitation of the vulnerability against their organization's self-hosted Gitea instance. Because Gitea enables open user registration and repository creation by default with no email confirmation or CAPTCHA, the attack chain is effectively unauthenticated: an automated scanner registered an account, created a repository, sent a malicious patch to diffpatch, executed code inside the Gitea container, and installed a crypto miner. The attack was fully automated and completed without human attacker involvement. The crypto miner payload fought for CPU resources against any other processes running in the Gitea container. Shadowserver Foundation tracks approximately 5,000 internet-exposed Gitea instances. The vulnerability was patched in Gitea version 1.27.1 released in July. CISA urges organizations to patch immediately, assess internet exposure, restrict open registration, and treat systems that were exposed with open registration as potential incident response cases rather than simple patching exercises.

Timeline

Domain Intelligence

Context

gitea.io scores 61.43 — a low-trust range score for the official domain of a widely deployed self-hosted development platform whose default configuration now constitutes a significant attack surface. Gitea has appeared in CISA's KEV catalog twice within two months: CVE-2026-20896, an authentication bypass flaw, was exploited in early July, and CVE-2026-60004 was added August 25. Two separate vulnerabilities in the same platform within the same quarter suggests either sustained attacker interest in Gitea as a target category or a broader pattern of security issues in the codebase. Open user registration as a default configuration is the operational detail that converts a vulnerability requiring write access into one that is effectively unauthenticated. Disabling open registration does not patch CVE-2026-60004, but it does remove the default-enabled attack path that makes the vulnerability exploitable without prior access.