Critical Gitea RCE CVE-2026-60004 Actively Exploited in Cryptojacking Campaign

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability in Gitea, tracked as CVE-2026-60004 (CVSS 9.8), to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. The flaw allows an attacker with repository write access to execute arbitrary shell commands as the Gitea OS user by abusing the diffpatch endpoint to install and execute a Git hook.

According to Gitea’s advisory, with default open registration, an unauthenticated visitor can register an account, create a repository, and obtain the necessary write access to trigger the exploit. The vulnerability affects all Gitea versions from 1.17 and is patched in version 1.27.1. Security researcher Shai rod (aka NightRang3r) is credited with discovering and reporting the issue.

CISA did not disclose specific exploitation details, but a full-stack developer named Andrey (aka @Causelof) published an analysis on the Russian blogging platform Habr describing how an unknown threat actor used CVE-2026-60004 to deploy a cryptocurrency-miner-like dropper on their Gitea instance. The incident was detected after hosting provider HOSTKEY alerted the user to excessive CPU usage exceeding 70% for an extended period, leading to temporary CPU resource limits on the VPS.

The dropper script performed several steps before deploying the miner payload: clearing LD_PRELOAD and LD_LIBRARY_PATH, searching for high-CPU processes, attempting to kill competing processes, fetching the payload based on system architecture, downloading and executing it, and deleting the file after execution. The exact nature of the next-stage payload remains unclear, as the user did not analyze its contents or confirm details about the mining pool, wallet, or miner family.

Federal agencies are required to patch the flaw by August 28, 2026, prioritizing updates based on a risk-based approach. Organizations using Gitea are strongly advised to upgrade to version 1.27.1 or later and to review their registration settings to mitigate exposure.