CISA Adds Critical Gitea RCE (CVE-2026-60004) to KEV Catalog as Active Attacks Drop Cryptominers
CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog. This is a CVSS 9.8 remote code execution flaw in Gitea, and it’s being actively exploited in the wild to deploy cryptocurrency miners on unpatched servers.
What’s the Vulnerability?
CVE-2026-60004 is an OS command injection flaw in Gitea’s diff/patch endpoint. An attacker with write access to any repository can abuse this endpoint to plant a malicious Git hook and execute arbitrary shell commands as the Gitea service account. The vulnerability affects all Gitea versions from 1.17 onward. It was patched in version 1.27.1.
Discovered by researcher Shai rod (NightRang3r), the flaw was initially reported in July 2026. Gitea issued a patch shortly after disclosure.
Active Exploitation Details
The attack chain works like this:
An attacker registers an account on a Gitea instance with open registration enabled (the default). They create a repository and push a malicious patch to the diff/patch API endpoint. The patch plants a Git hook that executes shell commands. The attacker now has code execution as the Gitea OS user.
Security researcher Andrey (@Causelof) documented a real-world attack against his Gitea instance. His hosting provider, HOSTKEY, flagged the server for exceeding 70% CPU usage over an extended period. Investigation revealed a cryptominer-like dropper had been deployed. The dropper used a multi-stage infection chain: it disabled the firewall, installed tools like net-tools and screen, downloaded a miner payload from strategic domains, and set up persistence through a systemd service. CPU usage spiked to 99%, consistent with cryptojacking activity.
Why This Matters
Gitea is widely deployed as a self-hosted Git server. Open registration is enabled by default, which means any unauthenticated user can sign up, create a repo, and exploit this flaw. Even if you don’t use open registration, any user with a repository — including compromised accounts — can trigger the exploit.
This is a classic case of a vulnerability that looked like it required authentication but, in practice, is trivially exploitable by external attackers because of default configurations.
Mitigation Steps
Patch immediately. Update Gitea to version 1.27.1 or later. This is the only complete fix.
Disable open registration if you don’t need it. Set REQUIRE_SIGNIN_VIEW to true in your Gitea configuration. This eliminates anonymous account creation as an attack vector.
Audit your Gitea instances for signs of compromise: unusual CPU spikes, unknown user accounts, unexpected repositories, or suspicious systemd services. Check for network connections to known mining pools.
Monitor network traffic from your Gitea server. Cryptominers often establish outbound connections to mining pools on non-standard ports.
Limit Gitea service account permissions. The Gitea OS user should have the minimum privileges needed to function. This won’t prevent exploitation but will limit blast radius.
Federal agencies have until August 28, 2026, to patch per the CISA binding directive. Everyone else should treat this as an immediate priority — the attackers are already scanning for vulnerable instances.