Over 8,300 Gitea Servers Remain Unpatched Against Critical Code Execution Flaw

The vulnerability, tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, is a code injection flaw in the diffpatch API endpoint. An attacker with write access to a repository can submit a malicious patch that installs and executes a Git hook, allowing arbitrary shell commands to run with the privileges of the Gitea service account.

Gitea comes with self-registration enabled by default, meaning an unauthenticated attacker can simply create an account, set up a new repository, and trigger the exploit without needing prior credentials. “Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user,” Gitea's security team explained in an advisory.

The Gitea project released version 1.27.1 on July 27 to address the flaw and urged administrators to upgrade immediately. Despite this, Shadowserver reported on August 27 that 8,393 unique IPs were still running vulnerable versions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added CVE-2026-60004 to its catalog of known exploited vulnerabilities, signalling that federal agencies must patch promptly.

System administrators who run self-hosted Gitea instances are advised to update to version 1.27.1 or later, and to review access controls, particularly if self-registration is enabled in production environments.

Why This Matters

Critical infrastructure risk: Gitea is a popular self-hosted Git service used by development teams to manage source code. A remote code execution flaw could allow attackers to compromise not just the Gitea server but also potentially pivot to other internal systems.
Active exploitation: Shadowserver’s warning and CISA’s addition indicate real-world attacks are ongoing, making prompt patching urgent.
Default configuration hazard: The default self-registration setting lowers the barrier for unauthenticated attackers, meaning many servers may be exposed even if they require authentication for existing repositories.

Background

Gitea is an open-source, self-hosted Git service forges similar to GitHub or GitLab. It is widely used by small-to-medium teams and enterprises that prefer to keep their code on-premises. The project frequently releases security updates, but administrators often lag behind in applying patches, especially for internet-facing instances.

Key Perspectives

Gitea developers: They released a fix within weeks of the vulnerability report and urged immediate upgrades. The advisory provides clear mitigation steps. System administrators: Many face operational constraints that delay patching, such as change management processes or lack of awareness. Some may rely on older versions that are no longer supported. Security researchers and watchdogs: Shadowserver and CISA highlight the scale of the exposure and the need for proactive scanning and reporting. The vulnerability’s ease of exploitation (no authentication required beyond registration) makes it especially dangerous.

What to Watch

Patch adoption rates: Shadowserver’s scans will show whether the number of vulnerable instances drops in the coming days.
Attack volume: Increases in exploitation attempts may prompt further advisories from CISA or broader industry warnings.
Default setting changes: Gitea may consider disabling self-registration by default in future releases to reduce the attack surface for similar vulnerabilities.

ZOTPAPER