Critical Gitea vulnerability is being actively exploited

CISA warns of active exploitation of CVE-2026-60004 in the self-hosted development platform Gitea. The vulnerability could allow attackers to execute commands on the server and has been fixed in version 1.27.1.

Organizations that run their own Gitea installations are urged to urgently check the software version and configuration.

The US Cybersecurity Agency CISA has added CVE-2026-60004 to its catalog of actively exploited vulnerabilities, Known Exploited Vulnerabilities. This means that the authority assesses that there is reliable evidence of actual exploitation. CISA's KEV entry for CVE-2026-60004

• 

  ADVERTISEMENT

  
  

• 

  OWN CONTENT

  
  

• 

  ADVERTISEMENT

  
  

• 

  SPONSORED

  
  

Malicious Git hook can be executed on the server

The vulnerability is in Gitea's diffpatch-function. Through a specially designed patch, a user with write access to a repository can install an executable Git hook.

When the hook is activated, the attacker can run arbitrary commands with the same operating system privileges as the Gitea service.

Depending on how the installation is isolated, a successful attack could provide access to:

• Gitea's configuration file and application secrets.
• Database information and database content.
• Mounted code repositories.
• OAuth and integration credentials.
• Secrets in the process's environmental variables.
• Other internal systems that the server can reach.

The vulnerability has been given a severity rating of critical and a CVSS score of 9.8. Gitea's official security advice

Open registration can lower the threshold

The attack normally requires an account with the ability to write to a repository.

However, on installations where open self-registration is enabled, an external visitor can create a regular account, establish a new repository, and thus gain the required access.

This means that the attack can in practice be carried out without a pre-existing user account on installations using this configuration.

For the exploit to work, Git 2.32 or later is also required, an enabled diffpatch-route and a temporary file space that is both writable and executable.

Version 1.27.1 contains the fix

The Security Council states that Gitea versions starting from 1.17 but older than 1.27.1 are affected. The fix is included in Gitea 1.27.1, which was released on July 27, 2026.

Gitea recommends all users to upgrade as soon as possible. Gitea's information about version 1.27.1

Updating should be combined with incident control

Since the vulnerability is now considered to be actively exploited, an upgrade should not be the only measure.

Organizations should also:

• Check all internet-connected Gitea installations and their versions.
• Upgrade to 1.27.1 or a later available version.
• Limit or close open user registration if the feature is not needed.
• Review recently created accounts and repositories.
• Investigate unexpected Git hooks and changes in temporary directories.
• Review Gitea, system, and network logs for unusual command execution.
• Rotate application, database, OAuth, and integration credentials if a breach is suspected.
• Isolate the server and conduct a full incident analysis in case of confirmed anomalies.

Gitea is often used as a self-hosted alternative to cloud-based development platforms. A breach can therefore affect source code, credentials, automated build flows, and connected production environments.