A critical vulnerability in Gitea, a widely used self-hosted Git service, is being actively exploited to plant cryptocurrency-mining malware on unpatched servers, according to reporting from The Hacker News and BleepingComputer published August 26 and 28, 2026, and confirmed by vulnerability-tracking service Shadowserver.
The flaw, tracked as CVE-2026-60004 and carrying a CVSS score of 9.8, allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea service account by submitting a malicious patch through the platform’s diffpatch API endpoint. Because Gitea’s default configuration permits open account registration, an unauthenticated attacker can obtain the necessary write access simply by creating an account and a repository, then trigger code execution — researcher Shai Rod (NightRang3r), who is credited with the discovery, described exploitation as achievable in seconds on a default install with zero prior credentials.
Cryptominer Payloads Observed, CISA Deadline Already Passed
Shadowserver identified more than 8,300 internet-exposed, vulnerable Gitea instances as of August 27, 2026. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on August 25 and ordered Federal Civilian Executive Branch agencies to patch by August 28. In at least one documented case, a developer’s Gitea instance was compromised by a dropper that cleared environment variables, killed competing processes, and fetched an architecture-specific cryptominer payload before deleting itself — consistent with opportunistic, automated scanning rather than a targeted campaign.
The vulnerability affects all Gitea versions from 1.17 onward and is fixed in version 1.27.1. Organizations running self-hosted Gitea instances, particularly those with open registration enabled, are advised to patch immediately and review recent repository and account activity for signs of compromise.
Leave a Reply