The U.S. Cybersecurity and Infrastructure Security Agency has issued a warning about active exploitation of a recently patched critical vulnerability in Gitea, a code-hosting platform, according to an alert published Tuesday. The flaw enables attackers to execute remote code and has been weaponized to install cryptocurrency miners on vulnerable servers. Federal agencies must remediate the vulnerability by August 28, 2026.
The security hole, identified as CVE-2026-60004 with a severity rating of 9.8 out of 10, permits an attacker holding standard write permissions on a repository to run arbitrary shell commands as the Gitea operating system user. The vulnerability affects every version of Gitea starting from version 1.17, and has been resolved in version 1.27.1. Security researcher Shai rod, also known as NightRang3r, discovered and disclosed the issue. A full-stack developer using the handle Andrey reported last week on Russian platform Habr that their Gitea installation was compromised by an unknown threat actor exploiting CVE-2026-60004 to deploy a cryptocurrency-mining dropper, an attack that came to light after their hosting provider HOSTKEY notified them that their virtual server was consuming over 70% of processor capacity for an extended duration. Before installing the mining payload, the dropper script cleared environment variables, searched for processes consuming high CPU resources, attempted to terminate competing processes, retrieved the payload matching the system architecture, downloaded and wrote it to disk, executed it, and then deleted the file.
CISA stated that "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account." Gitea's advisory from last month explains that "Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content," adding that "with default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository." The developer whose instance was attacked noted that the attack vector came through HTTPS rather than SSH, and emphasized that open registration proved significant specifically because of its link to the vulnerability, since a new user could register, establish their own repository, and gain the necessary write permissions within it.
The vulnerability's exploitability hinges on Gitea's default configuration settings, which permit open registration without email confirmation, allow OpenID signup, and don't require authentication to view pages or use the API. While the vulnerable API call technically requires authentication and repository write permission, the platform's default allowance of registration makes it possible for an external actor to create an account and repository, then trigger the exploit without relying on pre-existing credentials. The CPU usage spike documented in the real-world attack aligns with a cryptojacking campaign targeting vulnerable Gitea instances, though the developer stated they didn't analyze the next-stage payload and lacked confirmed details about the mining pool, wallet, miner family, or specific operator. CISA added the flaw to its Known Exploited Vulnerabilities catalog but didn't disclose details about how the security hole has been exploited in the wild or who's conducting the attacks, leaving uncertain whether the agency acted based on this specific incident or uncovered evidence of exploitation targeting unpatched Gitea servers in the U.S.
Federal agencies are required to patch the flaw by August 28, 2026, while prioritizing updates based on a risk-based approach. Organizations running Gitea should immediately upgrade to version 1.27.1 and review their registration settings to determine whether open registration aligns with their security posture. The incident underscores the speed with which attackers can weaponize disclosed vulnerabilities, particularly when default configurations lower the barrier to exploitation. Organizations that rely on self-hosted development tools face a choice between ease of onboarding and attack surface reduction, a tension that becomes acute when a single misconfigured setting can hand adversaries the keys to production infrastructure.