The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea.
The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea OS user.
“Gitea’s diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content,” according to an advisory released by Gitea last month. “With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.”
Security researcher Shai rod (aka NightRang3r) has been credited with discovering and reporting the issue. The issue affects all versions of Gitea from version 1.17 and has been patched in version 1.27.1.
As The Hacker News reported previously, while the vulnerable API call requires authentication and repository write permission, the fact that Gitea allows registration by default makes it possible for an external actor to create an account and a repository and then trigger the exploit without having to rely on pre-existing credentials.
“Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account,” CISA said.
The agency, which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, did not disclose any details of how the security flaw has been exploited in the wild or who is behind the efforts.
However, a full-stack developer named Andrey (aka @Causelof) pointed out in an analysis published last week on the Russian blogging platform Habr that their Gitea instance was targeted by an unknown threat actor using CVE-2026-60004 to deploy a cryptocurrency-miner-like dropper.
The incident came to light after receiving an email notification from hosting provider HOSTKEY, stating their virtual server had been using more than 70% of the processor capacity for an extended period of time in violation of the service’s terms, causing the provider to temporarily limit the available CPU resources to the VPS.
Specifically, the user cited the following configuration as responsible for driving the activity –
- DISABLE_REGISTRATION = false (If the parameter is enabled, only an admin can create accounts for users)
- REGISTER_EMAIL_CONFIRM = false (If the parameter is enabled, it asks for registration confirmation via email)
- ENABLE_OPENID_SIGNUP = true (The parameter allows registering via OpenID)
- REQUIRE_SIGNIN_VIEW = false (If the parameter is enabled, it forces users to log in to view any page or to use API)
“The fact that open registration is enabled here is significant precisely because of its connection to the vulnerability,” Andrey noted. “A new user could register, create their own repository, and obtain the necessary write permissions within it. Gitea’s SSH was not exposed to the outside world. The attack vector was via HTTPS.”
Before deploying the miner-like payload, the dropper script is said to have undertaken the following steps –
- Clear LD_PRELOAD and LD_LIBRARY_PATH
- Search for processes with high CPU usage
- Attempt to kill competing processes
- Fetch the payload based on the system architecture
- Download, write it to a location on disk, and run it
- Delete the file after execution
The exact nature of the next-stage payload is unknown, as the developer said they did not conduct an analysis of its contents, adding “I do not have confirmed information regarding the mining pool, wallet, miner family, or specific operator.” However, the spike in CPU usage lines up with a cryptojacking campaign targeting vulnerable Gitea instances.
It’s unclear if CISA added the flaw to the KEV catalog because of this specific attack, or if it has uncovered evidence of exploitation targeting unpatched Gitea servers in the U.S. Federal agencies are required to patch the flaw by August 28, 2026, while prioritizing updates based on a risk-based approach.
