CVE-2026-60004: CISA Gives Federal Agencies Until August 28 to Patch a Gitea Bug That Needs No Stolen Credentials — Just an Open Sign-Up Form
🚨 CRITICAL VULNERABILITY ALERT — Software Supply Chain / DevOps Infrastructure: CISA has confirmed active exploitation of a critical remote code execution flaw in Gitea, the widely used self-hosted Git platform, and added it to its Known Exploited Vulnerabilities catalog. Federal agencies must patch by August 28, 2026. If your organization self-hosts Gitea and has open self-registration enabled, treat this as a today problem — the exploit requires no stolen credentials at all.
Sources: CISA Known Exploited Vulnerabilities Catalog · SecurityWeek · The Hacker News · Security Affairs · Gitea Security Advisory GHSA-rcr6-4jqh-j84m | CVE: CVE-2026-60004 | CVSS: 9.8 (Critical) | Affected versions: Gitea 1.17 and later, patched in 1.27.1 | Federal patch deadline: August 28, 2026 | Discovered by: Shai-rod (NightRang3r)
What happened
On August 26, CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal civilian agencies to patch it within two days. The flaw sits in Gitea, an open-source, self-hosted alternative to GitHub or GitLab used by development teams that want to keep their Git infrastructure in-house rather than on a third-party cloud service.
The vulnerability is a code injection bug in Gitea’s diffpatch API. An attacker with ordinary repository write access — the kind any registered user has by default — can send a malicious patch through that endpoint to plant an executable Git hook. Once planted, that hook runs arbitrary shell commands as the Gitea service account. In practice, that means full command execution on the server hosting the Gitea instance.
The part that should worry security teams more than the CVSS score: Gitea ships with open self-registration enabled by default. An attacker doesn’t need to steal a password or find a leaked credential. They can register a new account, create a repository, and immediately have everything required to trigger the exploit — all without ever holding legitimate access to begin with.
| Field | Detail |
|---|---|
| CVE | CVE-2026-60004 |
| CVSS score | 9.8 (Critical) |
| Vulnerability type | Code injection / remote code execution via diffpatch API |
| Affected versions | Gitea 1.17 and later |
| Patched in | Gitea 1.27.1 (released late July 2026) |
| Access required | Ordinary repository write access — obtainable via open self-registration |
| Added to CISA KEV | August 26, 2026 |
| Federal patch deadline | August 28, 2026 |
| Observed payload | Cryptomining-style payload on at least one exposed instance |
| Attribution | Unattributed — CISA has not named a threat actor |
Why a 48-hour federal deadline matters to everyone else
CISA’s Known Exploited Vulnerabilities catalog only carries binding force for U.S. federal civilian agencies under Binding Operational Directive 22-01. Private enterprises aren’t legally required to hit the same deadline. But the KEV catalog exists precisely because CISA has evidence of exploitation happening in the wild right now — the two-day window isn’t a compliance formality, it’s a reflection of how fast the agency believes this needs to move.
A reported attack has already used the flaw to deploy a cryptocurrency-mining-style payload on an exposed Gitea instance that had open registration and anonymous web access enabled. The Gitea maintainers, who disclosed and patched the flaw in version 1.27.1 back in July, said they haven’t been able to confirm details about the mining pool, wallet, or operator behind that specific payload — which means the full scope of what’s being deployed through this vector is still unclear.
This isn’t the only Gitea vulnerability under active exploitation this year. A separate flaw, CVE-2026-20896, was reported under attack in early July and has not yet been added to the KEV catalog — a reminder that self-hosted DevOps infrastructure has become a recurring, not isolated, target.
The pattern behind the patch: default convenience becomes default risk
Open self-registration exists in Gitea for a reasonable purpose: it lowers friction for small teams and open-source projects who want people to be able to sign up and contribute without an administrator manually approving every account. On an internet-exposed instance, that same convenience becomes the entire authorization model attackers need to bypass.
This is the same root-cause pattern showing up across several disclosures this week. CERT/CC also disclosed two unpatched deserialization flaws in Kaltura’s widely distributed HTML5 video player library that allow unauthenticated remote code execution with nothing more than network access to the endpoint. And a separate authentication bypass was disclosed in the MiniOrange SAML 2.0 SSO plugin used on WordPress sites. None of these require a zero-day exploit chain or nation-state tradecraft. They require a default setting nobody turned off.
Immediate actions for DevOps and security teams
1. Patch to Gitea 1.27.1 or later now. This is the single action that closes CVE-2026-60004. Don’t wait for a maintenance window — CISA’s own deadline reflects the urgency here.
2. Inventory every self-hosted Gitea instance in your environment. Shadow DevOps infrastructure — a Gitea instance spun up by a team without central IT’s knowledge — is exactly the kind of asset that misses patch cycles. If it isn’t in your asset inventory, it isn’t in your patch tracking either.
3. Disable open self-registration on any internet-facing instance. Even after patching, review whether anonymous sign-up is actually necessary for your use case. If it isn’t, turn it off.
4. Check for unexpected CPU spikes or unfamiliar processes on Gitea hosts. The observed exploitation has involved a mining-style payload — unusual sustained CPU load is a practical, low-effort indicator to check right now while patching is in progress.
5. Audit repository write-access grants since version 1.17. Review which accounts were created through self-registration and whether any repositories were created or modified by accounts your team doesn’t recognize.
6. Extend the same urgency to Kaltura and MiniOrange SAML if applicable. If your environment uses Kaltura’s mwEmbed/html5lib player or the MiniOrange SAML 2.0 SSO plugin, treat those disclosures with the same priority — both allow unauthenticated compromise.
What happens next
Federal agencies have until Friday. Private enterprises don’t have a legal deadline, but they have the same exposure — and the same exploit is already being used in the wild. Expect more exposed instances to be identified and hit as scanners incorporate this CVE, which is the normal lifecycle for any KEV-listed flaw once it becomes public knowledge. The organizations that patch this week will be the ones that don’t spend next week doing incident response instead.
Sources and further reading
- CISA — Known Exploited Vulnerabilities Catalog
- SecurityWeek — CISA Warns of Exploited Gitea Vulnerability
- The Hacker News — Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
- Security Affairs — U.S. CISA Adds Gitea Flaw to Its Known Exploited Vulnerabilities Catalog
- Gitea Security Advisory GHSA-rcr6-4jqh-j84m
DataWater publishes daily cybersecurity threat briefs. Article #19 — August 26, 2026. See also: Iran-Linked UK Power Plant Attack (Aug 24) · Siemens S7 PLC Advisory AA26-231A (Aug 20) · Taiwan AI Agent Swarm (Aug 16).
