Hackers now exploit critical Gitea flaw in code injection attacks
Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). [...]
Source: BleepingComputer · August 26, 2026 at 1:04 PM · AI-assisted report
Single-sourceKUALA LUMPUR, 26 AUGUST 2026 —
Hackers Exploit Critical Gitea Flaw in Code Injection Attacks, CISA Warns
Market Impact
KUALA LUMPUR, Aug 26 — Cybersecurity authorities are warning of active exploitation of a critical-severity vulnerability in Gitea, a self-hosted Git service widely used by developers for version control and DevOps workflows. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw, tracked as CVE-2026-60004, to its Known Exploited Vulnerabilities (KEV) catalog and mandated U.S. federal agencies to patch affected systems within three days.
The vulnerability, reported by Salesforce security researcher Shai Rod, allows authenticated users with repository write access—or even unauthenticated attackers on default-configured instances—to execute arbitrary shell commands with the privileges of the Gitea service account. This is achieved by submitting malicious patches via the diffpatch API endpoint. Gitea’s security team confirmed that the flaw can be abused to install and execute Git hooks from repository-controlled content, enabling full system compromise.
Gitea released version 1.27.1 on July 27 to address CVE-2026-60004, urging users to upgrade immediately. Despite the patch, cybersecurity firm Shadowserver reports nearly 5,000 Gitea instances remain exposed online, though it remains unclear how many have been secured or are being used as honeypots. CISA’s inclusion of the flaw in the KEV catalog follows evidence of active exploitation in the wild, including the deployment of cryptocurrency mining malware on unpatched servers.
This marks the second critical Gitea vulnerability exploited in recent months. In July, threat actors targeted instances with reverse proxy authentication headers enabled, exploiting CVE-2026-20896, an authentication bypass flaw. Security experts warn that once attackers gain valid credentials, traditional prevention measures become less effective, highlighting the need for layered defenses.
For the Malaysian market, the risk is particularly relevant to organizations using self-hosted Git solutions for software development. While CISA’s directive applies only to U.S. federal agencies, the agency has urged all organizations to prioritize remediation of KEV catalog vulnerabilities. Industry observers note that many Malaysian enterprises, particularly in tech, finance, and government-linked sectors, rely on self-hosted Git platforms for internal collaboration and code management.
Industry analysts suggest that the exploitation of such flaws underscores broader challenges in open-source software security, where community-driven projects may lack patching cycles. Gitea, while popular for its lightweight and self-hosted nature, has faced increasing scrutiny as its user base grows. The rapid addition of CVE-2026-60004 to the KEV catalog reflects growing concerns over supply-chain risks in DevOps environments.
Looking ahead, security teams are advised to audit their Gitea deployments, disable open registration where unnecessary, and apply the latest patches promptly. The incident serves as a reminder of the persistent threat posed by unpatched software, even in niche but critical infrastructure components. Organizations are encouraged to adopt proactive vulnerability management strategies to mitigate risks associated with code injection and privilege escalation attacks.
Related: Gitea · Shai Rod · Kuala Lumpur