CVE-2026-60004

Over 8,300 Gitea Servers Remain Exposed to Remote Code Execution via CVE-2026-60004

Thousands of publicly accessible Gitea instances were still unpatched against CVE-2026-60004 as of late August 2026, leaving them open to remote command execution. The critical vulnerability combines abuse of the diffpatch endpoint with the ability to install and trigger attacker-controlled Git hooks, allowing unauthenticated attackers to run commands on the server. Exploitation requires only write access to a repository, which is often trivial due to default open user registration in many deployments. The issue was fixed in Gitea 1.27.1 released on July 27, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a remediation deadline of August 28 for U.S. federal agencies. In observed incidents, attackers used the access to deploy cryptocurrency miners inside Docker containers. A related authentication bypass affecting the official Docker image, CVE-2026-20896, was also noted when reverse-proxy headers such as X-WEBAUTH-USER are enabled.

Critical Gitea Vulnerability CVE-2026-60004 Allows Repository Writers to Execute Commands via Git Hooks

A critical vulnerability tracked as CVE-2026-60004 affects Gitea and enables remote command execution on the hosting server when an attacker possesses write permissions on a repository. The flaw is triggered by abusing Git hooks, which are small scripts that Git can automatically run at various points in the development workflow. Exploitation requires an authenticated account with write access, such as a collaborator or any role granted write permissions, making the issue particularly relevant for shared or multi-team repositories. Organizations that integrate Gitea into internal tooling face elevated risk because the server often has network visibility, access to shared storage, and proximity to sensitive credentials including CI/CD tokens and deployment keys. The recommended immediate actions include updating to the patched Gitea 1.27.1 release and auditing or disabling Git hooks wherever they are not strictly necessary. A publicly available proof-of-concept further increases operational urgency, prompting defenders to review permissions for external collaborators and rotate credentials if compromise is suspected.