Gitea RCE CVE-2026-60004: Critical Vulnerability Actively Exploited

TL;DR: If you're running Gitea versions 1.17 through 1.27.0, now is the time to panic (but stay calm). There's a critical vulnerability that allows an attacker to execute arbitrary code on your server — and it's already being actively exploited in the wild. Upgrade to 1.27.1 immediately, or read the full analysis below.

Table of Contents

1. Incident Summary
2. CVE Details: Numbers, Scores, and What They Mean
3. Affected Versions
4. Modus Operandi: How the Attack Works
5. Real-World Cases: Attacks in the Wild
6. Incident Timeline
7. What You Need to Do Now
8. Gitea Hardening Configuration
9. Key Takeaways
10. References and Links

Incident Summary

In mid-August 2026, the cybersecurity community was rocked by reports of a critical vulnerability in Gitea — the popular self-hosted Git platform favored by developers and privacy-conscious organizations.

CVE-2026-60004, with a CVSS score of 9.8 (Critical), enables Remote Code Execution (RCE), allowing an attacker to run arbitrary commands on any server running Gitea. Making matters worse: this vulnerability is already being actively exploited in real-world attacks and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

In this blog post, we'll take a deep dive into what actually happened, how the attack works, who's affected, and — most importantly — what mitigations you need to take.

CVE Details: Numbers, Scores, and What They Mean

Let's break down the technical details of this vulnerability:

What Does a CVSS Score of 9.8 Mean?

A CVSS score of 9.8 puts this vulnerability in the most dangerous tier possible. Let's break down the attack vector:

• AV:N (Attack Vector: Network) — The attack is performed remotely, over the network. No physical or local access required.
• AC:L (Attack Complexity: Low) — No complex conditions need to be met. The attack is relatively easy to carry out.
• PR:N (Privileges Required: None) — No authentication required. The attacker doesn't need an account on Gitea (though in practice, they do need to register one to exploit this — more on that in the modus operandi section).
• UI:N (User Interaction: None) — No interaction from other users is needed. The attacker can carry out the attack independently.
• S:U / C:H / I:H / A:H — Confidentiality, Integrity, and Availability are all impacted at High. This means the attacker can read all data, modify data, and take down the entire service.

Bottom line: this is a near-perfect CVSS score. Patching is mandatory — there's no excuse for delaying.

Affected Versions

Gitea Versions Affected

This vulnerability affects all Gitea versions from 1.17.x through 1.27.0. That's a wide range — many long-running Gitea installations are likely still running a vulnerable version.

Gitea Versions Safe

• Gitea >= 1.27.1 — Safe from CVE-2026-60004.

How to Check Your Gitea Version

If you're not sure which version of Gitea is running, here are several ways to find out:

Via the Web Interface:

• Log into Gitea → click the profile icon → scroll down → check the version in the footer.

Via the Command Line:

# Run the following command on your Gitea server
gitea --version
 
# Or check from the running binary
/path/to/gitea --version

Via the API:

# GET the Gitea version via the public API
curl -s http://your-gitea-instance/api/v1/version | jq .

If your version is still below 1.27.1, stop reading and update now. This article will be here when you're ready to read the analysis.

Modus Operandi: How the Attack Works

This is the most interesting part from a technical perspective. Let's walk through step-by-step how an attacker can exploit CVE-2026-60004.

Step 1: Register an Account

The attacker starts by registering a new account on the target Gitea instance. On many Gitea installations, new account registration is open to anyone (the open registration feature). This is the first prerequisite for launching the attack.

Step 2: Create a New Repository

After successfully creating an account, the attacker creates a new repository. This repository will be used as a vehicle to deliver the malicious payload.

Step 3: Prepare the Payload

The attacker prepares a specially crafted payload designed to exploit the vulnerability in the diff/patch endpoint. This endpoint processes diffs between files — and that's exactly where the weakness lies.

The vulnerability exists in how Gitea processes patch/diff data. There is insufficient sanitization or improper validation on the input received by this endpoint, allowing the attacker to inject malicious code into the patching process.

Step 4: Trigger the Exploit via HTTPS

With the payload ready, the attacker sends an HTTP (HTTPS) request to the vulnerable diff/patch endpoint. This request triggers the vulnerability and ultimately enables arbitrary command execution on the server.

What makes this particularly interesting — the attack is carried out entirely through standard HTTP requests. No complex exploit chains, no multiple primitives required. Just register an account, create a repo, send the payload. Clean and simple.

Attack Flow Diagram

[Attacker]
    │
    ▼
[1] Register account on Gitea ─── Open registration must be enabled
    │
    ▼
[2] Create new repository ─── Any repo will do
    │
    ▼
[3] Prepare payload ─── Crafted diff/patch data
    │
    ▼
[4] Send request to /diff endpoint ─── Via HTTPS
    │
    ▼
[5] RCE achieved! ─── Arbitrary code runs on server
    │
    ▼
[6] Attacker fully controls server ─── Can install miner, reverse shell, etc.

Why Is This So Dangerous?

1. No authentication required — While the attacker does need to register, they don't require any special permissions or admin tokens.
2. Single-step exploitation — No complex exploit chain. A single request is sufficient.
3. Network-accessible — Can be exploited from anywhere with HTTP access to the Gitea instance.
4. High impact — Escalates to full system control.

Real-World Cases: Attacks in the Wild

Bitcoin Mining on Victim Servers

This vulnerability isn't just theoretical. In reported real-world attacks, attackers successfully deployed cryptocurrency miners on victim Gitea servers. Here's the attack chronology that came to light:

Target: A Gitea installation running a vulnerable version with open registration.

Attack Flow:

1. The attacker created an account on the target Gitea.
2. Created a repository and uploaded files that triggered the vulnerability in the diff/patch endpoint.
3. Malicious code executed on the server — downloading and running XMRig (a Monero cryptocurrency miner).
4. The miner ran in the background, consuming the server's CPU to mine cryptocurrency.
5. The server became sluggish, with CPU usage spiking to 100%.

Impact:

• Infrastructure costs skyrocket — 100% CPU usage means cloud computing bills go through the roof.
• Service performance degrades — Gitea becomes extremely slow or unresponsive.
• Potential data breach — The attacker has full server access, meaning all data (source code, credentials, database) could be exposed.
• Crypto wallets at risk — If there are wallet files or credentials on the server, the attacker can steal them.

Who Is Most at Risk?

Based on these real-world attacks, the primary targets are:

• Gitea with open registration — This is the main prerequisite for exploitation.
• Gitea exposed to the internet — If it's only accessible from an internal network, the risk is lower.
• Servers with minimal monitoring — Without alerts for CPU spikes or suspicious processes, the attack can go undetected for days.

Incident Timeline

Here's the full timeline from disclosure to exploitation:

Notice the Gap Between Patch and Exploitation

There's a multi-week window between the patch release (early August) and the start of mass exploitation (mid-August). This is a critical window of opportunity. Many organizations don't update immediately after a patch is released, and attackers exploit this gap to hit unpatched installations.

Key lesson: Don't delay patching. Attacks don't wait for you to come back from vacation.

What You Need to Do Now

Priority 1: Update Gitea (CRITICAL)

This isn't a choice — it's a responsibility. Update Gitea to version 1.27.1 or newer right now.

# Back up first (MANDATORY!)
cp -r /path/to/gitea /path/to/gitea-backup-$(date +%Y%m%d)
 
# Download the latest version
wget https://dl.gitea.com/gitea/1.27.1/gitea-1.27.1-linux-amd64
 
# Stop the Gitea service
systemctl stop gitea
 
# Replace the binary
cp gitea-1.27.1-linux-amd64 /path/to/gitea/gitea
chmod +x /path/to/gitea/gitea
 
# Start the service
systemctl start gitea
 
# Verify the version
gitea --version

Priority 2: Disable Open Registration

If your Gitea doesn't need public registration, turn it off now. This eliminates the most common attack vector.

Edit app.ini (typically located at /etc/gitea/app.ini):

[service]
DISABLE_REGISTRATION = true

Or, if you still want registration active but more controlled:

[service]
DISABLE_REGISTRATION = false
REQUIRE_EMAIL_CONFIRMATION = true

Restart Gitea after changing the configuration:

systemctl restart gitea

Priority 3: Review Existing Accounts

After patching and disabling registration, audit the existing accounts on your Gitea:

• Check if any unfamiliar accounts were created in the past few days.
• Inspect repositories for suspicious activity (odd contents or unrecognized payloads).
• Review Gitea access logs for anomalies.

# Example: check Gitea logs for suspicious activity
grep -i "diff\|patch" /path/to/gitea/log/gitea.log | tail -50

Priority 4: Monitor for Indicators of Compromise (IoC)

To check if your server has already been hit:

# Check for cryptocurrency miner processes
ps aux | grep -i "xmr\|minergate\|miner\|coin"
 
# Check for suspicious network connections
netstat -tlnp | grep -v "gitea\|sshd\|nginx\|apache"
 
# Check for unknown binary files in /tmp or /var/tmp
find /tmp /var/tmp -type f -executable -ls
 
# Check for suspicious scheduled tasks
crontab -l
ls -la /etc/cron.d/

Priority 5: If You've Already Been Compromised

If you suspect your server has been exploited, stay calm but act quickly:

1. Isolate the server from the network (but don't shut it down — you'll need it for forensics).
2. Preserve logs — don't delete anything. Back up all logs.
3. Scan the entire system with security tools.
4. Rotate all credentials that were ever on that server.
5. Rebuild from a clean state — after forensics are complete, rebuild the server from scratch. Don't just delete suspicious files.
6. Report the incident per your organization's incident response policy.

Gitea Hardening Configuration

After patching CVE-2026-60004, it's worth performing a thorough hardening of your Gitea installation. Here are the recommended configurations:

1. Disable Registration or Use Email Confirmation

# /etc/gitea/app.ini
 
[service]
; Option A: Completely disable registration
DISABLE_REGISTRATION = true
 
; Option B: Keep registration enabled but require email confirmation
DISABLE_REGISTRATION = false
REQUIRE_EMAIL_CONFIRMATION = true

2. Restrict Access with a Reverse Proxy

Use Nginx or Caddy as a reverse proxy for Gitea with strict rules:

# /etc/nginx/conf.d/gitea.conf
 
server {
    listen 443 ssl http2;
    server_name git.example.com;
 
    # SSL Configuration (required)
    ssl_certificate /etc/ssl/certs/gitea.pem;
    ssl_certificate_key /etc/ssl/private/gitea.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
 
    # Rate limiting — restrict requests to mitigate abuse
    limit_req zone=gitea burst=20 nodelay;
    limit_conn gitea 50;
 
    # Security headers
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'";
    add_header Referrer-Policy "strict-origin-when-cross-origin";
 
    # Proxy to Gitea
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
 
    # Block API access from unknown IPs (optional)
    location /api/v1 {
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        allow 192.168.0.0/16;
        deny all;
        proxy_pass http://127.0.0.1:3000;
    }
}
 
# Rate limiting zone
# Add this to the main http block in nginx.conf:
# limit_req_zone $binary_remote_addr zone=gitea:10m rate=10r/s;
# limit_conn_zone $binary_remote_addr zone=gitea:10m;

3. Firewall Rules

# UFW — only open SSH and HTTPS
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable
 
# Or iptables — rate-limit the HTTPS port
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 50 -j DROP
iptables -A INPUT -p tcp --dport 443 -m hashlimit --hashlimit-above 50/sec --hashlimit-mode srcip -j DROP

4. File Permissions

# Ensure the Gitea binary can't be modified by other users
chown root:root /path/to/gitea/gitea
chmod 755 /path/to/gitea/gitea
 
# Ensure the Gitea data directory is only accessible by Gitea
chown -R git:git /path/to/gitea-data
chmod 750 /path/to/gitea-data

5. Audit Logging

# /etc/gitea/app.ini
 
[log]
; Enable sufficiently detailed logging
LEVEL = Info
MODE = file
; Or for more detailed audit logging:
LEVEL = Warn

6. Dashboard and Repository Settings

Via the web interface:

• Site Administration → Authentication Source → Ensure only the SMTP or LDAP sources you need are enabled. Disable anything unnecessary.
• Site Administration → Configuration → Disable API access if it's not required.
• Repository Settings → Restrict who can create new repositories.
• User Settings → Disable access for inactive users.

Key Takeaways

1. Self-Hosted ≠ Self-Secure

Many people assume that self-hosted means more secure. The reality is, self-hosted also means self-responsibility. If the vendor doesn't release a patch quickly, or you don't update promptly — that's on you.

2. Open Registration Is an Attack Surface

This is a classic lesson that keeps repeating: the more open your service is, the greater the risk. Open registration on Gitea (or any platform) is an invitation for attackers to play around in your infrastructure.

Best practice: Disable registration if it's not truly needed. If it must be enabled, use email verification and human verification (captcha).

3. Patch Management Is a Requirement, Not an Option

Mature security organizations have automated patch management pipelines. If you're still relying on humans to remember to update, you've already lost.

Consider:

• Subscribing to security advisories from your software vendors.
• Using monitoring tools like Dependabot (for dependencies) or Trivy (for container images).
• Setting up automated testing pipelines for patch updates before deploying to production.

4. Good Monitoring = Faster Detection

Cryptocurrency mining attacks are very easy to detect with proper monitoring:

• CPU usage alerts — Alert when CPU usage stays above 80% consistently.
• Process monitoring — Alert on new, unrecognized processes.
• Network monitoring — Alert on outbound connections to mining pools.
• Log aggregation — Centralize all logs for analysis.

If you're using Prometheus + Grafana or another monitoring stack, set up alerting rules for these anomalies. Early detection = faster response = less damage.

5. Defense in Depth

Don't rely on a single layer of defense. A sound strategy looks like:

• Layer 1: Timely software updates (patch management).
• Layer 2: Hardened configuration (disable unnecessary features).
• Layer 3: Network security (firewall, rate limiting, reverse proxy).
• Layer 4: Monitoring and alerting (anomaly detection).
• Layer 5: Incident response plan (if all the above layers fail).

6. Responsible Disclosure Matters

Shai rod discovered this vulnerability and performed responsible disclosure to the Gitea team. Without that, this vulnerability might have been exploited for much longer before anyone knew about it. If you discover a vulnerability, disclose it responsibly.

References and Links

• NVD (National Vulnerability Database): CVE-2026-60004
• CISA KEV Catalog: Known Exploited Vulnerabilities
• Gitea Security Advisory: GHSA for CVE-2026-60004
• Gitea 1.27.1 Release Notes: Release Page
• Discoverer: Shai rod (NightRang3r) — thank you for the responsible disclosure!