Gitea Under Attack: Critical RCE Exploited for Cryptojacking, CISA Mandates Patch by August 28

A CVSS 9.8 Code Injection Lands in the KEV Catalog

On August 25, 2026, CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The vulnerability affects Gitea, the open-source self-hosted Git platform, and is described as a code injection with a CVSS score of 9.8.

According to the official description, the flaw allows an attacker with write access to a repository to submit a malicious patch to the diffpatch API endpoint. The goal is to install an executable Git hook and achieve shell command execution with the privileges of the Gitea service account.

CISA has confirmed exploitation in the wild, but has not released details on the attack techniques or attribution. It is also unknown whether this CVE is being used in ransomware campaigns: the “Known To Be Used in Ransomware Campaigns” field is listed as Unknown.

The Vector: Open Registration and Git Hooks

The credited researcher for the discovery is Shai Rod, also known as NightRang3r. The diffpatch endpoint can be abused to turn repository-controlled content into an executable Git hook. From there, the attacker executes commands as the service account, bypassing application controls.

The condition that makes the attack particularly dangerous is Gitea's default open registration. With this setting, an unauthenticated visitor can register an account, create a repository, and gain the write permissions needed to launch the attack. No pre-existing credentials or privileged access are required.

Affected versions include all Gitea releases starting from 1.17. The fix was released in version 1.27.1. CISA/NVD materials do not explicitly list affected versions; this information comes from the vendor advisory.

Cryptojacking Observed on a Personal Instance

A recently published independent analysis describes a concrete attack against a personal Gitea instance. An unidentified actor exploited CVE-2026-60004 to deploy a cryptocurrency miner dropper.

The incident came to light after an email from the hosting provider HOSTKEY. The provider reported that the virtual server had exceeded 70% CPU capacity for an extended period, violating the terms of service. HOSTKEY temporarily restricted the VPS CPU resources.

The compromised instance's configuration was particularly exposed: DISABLE_REGISTRATION was set to false, REGISTER_EMAIL_CONFIRM to false, ENABLE_OPENID_SIGNUP to true, and REQUIRE_SIGNIN_VIEW to false. Gitea SSH was not exposed: the attack vector was entirely over HTTPS.

Before deploying the payload, the dropper performed a sequence of operations: clearing LD_PRELOAD and LD_LIBRARY_PATH, searching for processes with high CPU usage, attempting to terminate competing processes, downloading the payload based on system architecture, writing it to disk and executing it, and finally deleting the file. The exact nature of the second-stage payload is unknown: there is no confirmed information on mining pools, wallets, miner family, or operator. The increased CPU usage remains consistent with a cryptojacking campaign against vulnerable Gitea instances.

It is unclear whether CISA added the CVE to the KEV because of this specific attack or because it collected other evidence of exploitation against unpatched Gitea servers.

Mitigations and Deadlines for Federal Agencies

The action required by CISA is to apply mitigations according to vendor instructions, in accordance with BOD 26-04 “Prioritizing Security Updates Based on Risk” and the “Forensics Triage Requirements.” U.S. federal agencies must complete remediation by August 28, 2026.

For this entry, CISA does not require mandatory forensic triage: the “Forensic triage required per BOD-26-04” field is set to No. However, BOD 26-04 still establishes pre-patch controls for federal agencies, particularly for internet-exposed assets.

The primary mitigation is to upgrade Gitea to version 1.27.1 or later. For cloud services, organizations must follow BOD 26-04 guidelines or discontinue the product if mitigations are not available.

Although not formally listed as a workaround in the advisory, the incident analysis highlights that instances with open registration, email confirmation disabled, OpenID signup enabled, and viewing without login are particularly exposed. Restricting registration and requiring email confirmation can reduce the attack surface.

A KEV Under Pressure in Recent Weeks

CVE-2026-60004 is not the only recent entry in the KEV catalog. Between August 18 and 24, 2026, several critical vulnerabilities entered the catalog with tight remediation deadlines: CVE-2026-65400 (CVSS 9.8) with a deadline of August 21, CVE-2026-55040 (CVSS 9.1) with a deadline of August 21, CVE-2026-73570 (CVSS 8.9) with a deadline of August 24, and CVE-2026-21962 (CVSS 10) with a deadline of August 27.

This sequence shows increasing pressure on organizations to reduce patching times. The August 28 deadline for Gitea leaves federal agencies just three days from the time of KEV inclusion: a particularly tight interval, consistent with the BOD 26-04 approach for high-risk vulnerabilities on publicly exposed assets.