Attackers are actively exploiting a critical remote code execution vulnerability in Gitea, the popular self-hosted Git platform used by thousands of development teams worldwide. The flaw, tracked as CVE-2026-60004, lives in Gitea’s diffpatch API endpoint and allows any authenticated user to execute arbitrary shell commands with the privileges of the Gitea service account. Observed payloads have been cryptocurrency miners, installed quietly on compromised servers.
The severity is compounded by a common Gitea default: open self-registration is enabled out of the box. That means an attacker needs no pre-existing credentials — they simply register a free account, create a repository, and trigger the vulnerability immediately. Security researcher Shai Rod of Salesforce discovered the flaw. CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on August 25, mandating U.S. federal agencies patch within three days.
How to check if you’re affected
Affected versions include all Gitea releases prior to 1.27.1. Log in to your Gitea admin panel and check Site Administration → Dashboard for your current version number. If it reads anything below 1.27.1, update immediately — the fixed release shipped July 27, 2026. If you cannot update right away, disable open self-registration in your instance settings as a temporary mitigation.