A developer in Russia noticed their virtual server's CPU had been pinned high for days. Their hosting provider flagged it. What they found, when they went looking, was that someone had walked in through the front door of their self-hosted Gitea instance — registered an account, created a repository, and executed code on the box. The active phase of the attack, by their own reconstruction, took about eleven seconds.
That incident report, posted to the Russian technical blog Habr, is the most detailed public account of exploitation of CVE-2026-60004, a critical code injection flaw in Gitea that the U.S. Cybersecurity and Infrastructure Security Agency added to its Known Exploited Vulnerabilities catalog on Tuesday, August 25. Federal civilian agencies have until Friday, August 28, to remediate — a three-day clock, not the two weeks the old rules allowed.
What The Flaw Actually Is
Gitea is the self-hosted alternative to GitHub and GitLab: an open-source, Go-based Git platform organizations run on their own infrastructure precisely because they do not want their source code on someone else's servers. CVE-2026-60004 carries a CVSS v3.1 base score of 9.8 and affects every release from 1.17 up to but not including 1.27.1.
The mechanics, at a high level: Gitea's diffpatch API endpoint applies a submitted patch inside a temporary clone, and attacker-controlled patch content could end up written into the repository's hooks directory — where Git will happily execute it. The result is shell command execution under the Gitea service account.
"Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user," the project's security team wrote in advisory GHSA-rcr6-4jqh-j84m. "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository."
That second sentence is the whole story. On paper this is an authenticated vulnerability requiring repository write access, which sounds like an insider problem. In practice, Gitea ships with self-registration enabled by default, so the authentication requirement collapses into a signup form. In the Habr case, the instance had open registration with no email confirmation and no CAPTCHA — an automated scanner did the rest.
The bug was reported by Salesforce security researcher Shai Rod and privately disclosed to maintainers. Gitea shipped the fix in version 1.27.1 on July 27, 2026, with the formal advisory following on July 28. The current release is 1.27.2. Gitea Cloud instances were upgraded automatically; the exposure is entirely on the self-hosted side — the organizations that chose self-hosting for control and own the patching burden that comes with it.
Shadowserver tracks close to 5,000 internet-exposed Gitea instances. That number is a ceiling, not a victim count — it includes honeypots and already-patched servers — but it sizes the attack surface. Payloads observed so far have been mundane: a shell loader followed by a cryptocurrency-miner-style dropper. In the documented compromise, Gitea ran inside a non-privileged Docker container, the miner did not survive a restart, and no persistence via cron, systemd, or new SSH keys was found. The developer's response was the correct one — upgrade, disable open registration, strip extra signup methods, rotate every secret and token, tighten container networking, and block outbound internet from the container.
Why It Matters
Crypto-mining is the least interesting thing an attacker can do with code execution on a Git server, and treating this as a mining story badly undersells it.
A Gitea instance is a source-code repository, but in 2026 it is also increasingly an execution environment. It hosts Actions runners. It holds deploy keys, webhook secrets, OAuth client credentials, database connection strings in the app.ini configuration file, and process-environment variables. Depending on isolation and the privileges of the service account, successful exploitation can expose all of it. Anyone with that material does not need to keep exploiting the vulnerability; they have credentials.
Layer the AI development stack on top. Self-hosted Git is where regulated industries, defense contractors, and privacy-conscious engineering teams put the code they will not send to a SaaS platform — and it is exactly where coding agents are now pointed. Agents clone from these servers, read the codebase as context, open pull requests against them, and run in CI pipelines whose tokens sit adjacent to the same box. A server that can be made to execute arbitrary commands is a server where repository contents can be modified. An agent that reads a poisoned repository as ground truth propagates whatever it reads, and the resulting pull request arrives wearing the credibility of automation.
The policy shift matters too. Under BOD 22-01, issued in November 2021, KEV additions carried flat deadlines, typically two weeks. CISA replaced it on June 10, 2026 with BOD 26-04, "Prioritizing Security Updates Based on Risk," which grades vulnerabilities by exposure, exploitation evidence, adversary automation capability, and technical impact. Roughly 1 percent land in the three-day tier; about 60 percent can be deferred. Gitea landed in the 1 percent. The directive explicitly cites adversary automation — how fast attackers weaponize a public proof of concept — as a scoring input, and this advisory shipped with a PoC included.
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA wrote in its KEV alert, adding that while BOD 26-04 binds only federal civilian agencies, "CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."
What To Watch
Three things. Whether the payloads stay boring — miners are noisy and get caught, while credential theft from app.ini is quiet and never spikes a CPU graph. Whether the Shadowserver exposure count moves before Friday, the only real-time signal on whether a three-day federal deadline pulls the broader install base with it. And whether anyone documents the scenario this bug class enables but nobody has yet reported: a modified upstream repository that an AI coding agent read, trusted, and shipped downstream. Gitea also patched a critical authentication bypass, CVE-2026-20896, exploited in July. Two exploited criticals in two months is a pattern.
“An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user.”— Gitea security team, Advisory GHSA-rcr6-4jqh-j84m