Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
Summary: CISA warned Tuesday of active exploitation of CVE-2026-60004, a remote code execution flaw with a CVSS score of 9.8 in Gitea that lets anyone with ordinary repository write access run shell commands as the Gitea OS user by abusing the diffpatch endpoint to plant an executable Git hook. The flaw affects all Gitea versions from 1.17 and is patched in 1.27.1, and CISA added it to its Known Exploited Vulnerabilities catalog with a federal patch deadline of August 28, 2026.
Key Takeaway: Gitea's default open registration means an outside attacker can create an account and repository to get the write access the exploit needs, no stolen credentials required - and one developer on Habr reported exactly that path being used to deploy a miner-like dropper after their provider flagged sustained CPU use above 70%.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-60004
- Related
- CVE-2026-60004: Gitea Code Injection Vulnerability Known Exploited Vulnerabilities · Aug 25, 2026