Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
- ID
- 18004
- Status
- summarized
- Published
- 26 Aug 2026, 2:27 PM
- Fetched
- 26 Aug 2026, 3:24 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.0
- Created
- 26 Aug 2026, 3:25 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
CISA has added CVE-2026-60004 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog after active exploitation was observed against unpatched Gitea instances. The flaw lets any user with repository write access execute arbitrary shell commands via the diffpatch endpoint, and because Gitea enables open registration by default, an outsider can register, create a repo, and trigger the RCE without prior credentials. A developer reported their instance was compromised to deploy a crypto-miner-like dropper after their hosting provider flagged >70% CPU usage. The fix is in Gitea 1.27.1; all versions from 1.17 are affected.
Why it matters
If you self-host Gitea (common for cost-conscious startups and homelab builders), patch to 1.27.1 now and disable open registration if you don't need public sign-ups — the default config makes exploitation trivial. This is not theoretical; CISA KEV listing means active attacks are happening.
Discussion angle
How many of us running self-hosted Gitea instances actually checked whether open registration is still on after this — and what's our patch lag story for self-hosted infra versus managed services like GitHub/GitLab?