Gitea under attack: critical RCE CVE-2026-60004 in KEV catalog, over 8,300 servers exposed

A critical flaw in Gitea's diffpatch

The vulnerability CVE-2026-60004 affects Gitea versions prior to 1.27.1 and allows remote code execution via the diffpatch API, with the installation of an attacker-controlled Git hook. The bug was reported by Salesforce researcher Shai Rod, as reported by BleepingComputer.

Gitea released the fix version 1.27.1 on July 27. Despite the patch being available for several weeks, the situation remains critical: Shadowserver identified 8,393 vulnerable IP addresses as of August 27, 2026. BleepingComputer's headline mentions over 8,300 exposed servers; in the article body the number rises to nearly 8,400. The precise Shadowserver figure of 8,393 IPs is the reference one.

CISA added the CVE to the Known Exploited Vulnerabilities Catalog on August 25, 2026, with a deadline for US federal civilian agencies (FCEB) set for August 28, 2026, based on Binding Operational Directive BOD 26-04.

How the attack works technically

CVE-2026-60004 has a CVSS 3.1 score of 9.8, considered critical, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and classification CWE-94 (Code Injection). The GitHub advisory GHSA-rcr6-4jqh-j84m describes the mechanism in detail.

The file services/repository/files/patch.go applies attacker-controlled patches in a shared temporary bare clone. Sending the same patch twice generates an add/add collision. At that point Git's three-way fallback checks out the indexed path even though the operation is performed with --cached.

In a bare clone the repository root coincides with $GIT_DIR. An executable entry named hooks/post-index-change thus becomes an active Git hook. Git invokes the hook while writing the index: the repository-controlled content executes arbitrary commands as the Gitea system user, normally git. The advisory shows an output with uid=1000(git) gid=1000(git) and a temporary path under /data/gitea/tmp/.

A relevant detail: the hook's return value is not propagated to the diffpatch response. The attached proof of concept saves the command output into Git objects and creates a branch with the result, so no outbound connection is needed. The result is retrieved via authenticated smart HTTP.

Open registration is only necessary for the attack path without prior credentials. With default open registration, an unauthenticated visitor can register, create a repository, and obtain the necessary write access. Disabling open registration blocks that path, but the risk remains for users with write access to repositories. The script provided with the advisory, gitea_diffpatch_rce_poc.py, uses an existing Gitea account and should be run against test instances where the account can create repositories.

Active exploitation and CISA guidance

Inclusion in the KEV catalog signals that the flaw is not theoretical: it is being exploited in the wild. CISA has not yet provided details about the attacks, but according to BleepingComputer the decision was likely motivated by reports of exploitation involving distribution of cryptomining malware on unpatched Gitea servers.

For US federal agencies the deadline to apply mitigations was August 28, 2026. The action required by CISA is to apply mitigations according to vendor instructions, in compliance with BOD 26-04 “Prioritizing Security Updates Based on Risk” and the “Forensics Triage Requirements”. For cloud services, the applicable BOD 26-04 guidance must be followed, or the product must be decommissioned if mitigations are not available. Administrators must assess the internet exposure of each asset and ensure adherence to BOD 26-04 guidelines.

A second critical issue: CVE-2026-20896

This is not the first recent critical flaw for Gitea. In July, also according to BleepingComputer, malicious actors abused CVE-2026-20896, another vulnerability with CVSS 9.8, this time in the official Gitea Docker image.

CVE-2026-20896 is classified as CWE-284 (Improper Access Control). Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* as the default setting. This allows any source IP to impersonate a user when reverse proxy authentication headers such as X-WEBAUTH-USER are enabled. BleepingComputer describes it as an authentication bypass affecting Gitea instances with reverse proxy authentication headers enabled.

The NVD entry does not indicate an explicit fixed version for CVE-2026-20896. It appears that versions up to 1.26.2 are affected. In the absence of further guidance, it is necessary to verify vendor updates for the Docker image.

What to do

For CVE-2026-60004 the only indicated remediation is to update Gitea to version 1.27.1 or later. No official alternative workarounds appear in the consulted sources. Disabling open registration reduces exposure to the path without prior credentials, but does not eliminate the risk for those with write access to repositories.

Anyone managing an internet-exposed Gitea instance should immediately check the installed version. Shadowserver's figure of 8,393 vulnerable IPs as of August 27 indicates that thousands of servers have not yet applied the patch.

For CVE-2026-20896, it is necessary to check for updates to the official Docker image and, in the meantime, verify the configuration of REVERSE_PROXY_TRUSTED_PROXIES and reverse proxy authentication headers. The presence of two critical vulnerabilities within a few weeks makes Gitea a concrete target for those seeking exposed code hosting servers.