A self-hosted Git server looks like a boring internal utility right up until it becomes the key to your entire development pipeline. That is exactly what is happening with Gitea, the popular lightweight self-hosted GitHub alternative that runs in thousands of companies, homelabs, and internal environments. CVE-2026-60004, rated CVSS 9.8, is already under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog with a federal patch deadline of 28 August, and in the wild it is being used to drop a cryptocurrency-miner payload.
How it works: a legitimate feature turned into RCE
The flaw lives in the diffpatch feature. A user with write access to a repository submits a specially crafted malicious patch twice, and the result is an executable file written into that repository’s hooks/ directory. Then a fundamental Git behavior takes over: server-side hooks (post-receive, update, pre-receive) are executed by the server itself on repository operations. The planted hook fires and runs arbitrary commands as the Gitea service account. An ordinary patch operation becomes code execution on the host.
This is not exotic, it is a recurring pattern: server-side git hooks have been a powerful RCE surface for years, and any ability to write into hooks/ is effectively command execution. Gitea itself grew as a fork of Gogs, and this class of issue has surfaced in the lineage before. The lesson is constant: wherever a legitimate feature grants a write into an executable path, RCE eventually follows.
Why “needs write access” is not a wall
The first reaction is that write access means insiders only. But Gitea ships with open registration enabled by default. On an unpatched instance, any passerby from the internet creates a normal account, spins up their own repository, automatically gets write access to it, and exploits the bug with no pre-existing credentials. That makes it a near-unauthenticated RCE. Internet scans put more than 8,300 vulnerable servers exposed, and that is only the visible portion.
The window between disclosure and exploitation collapsed to days in 2026: the patch shipped in late July (version 1.27.1), and by late August the flaw was in KEV with real-world attacks. A classic n-day, where every day you wait to upgrade is a day the door is open.
Why a Git server is Tier-0
The crypto-miner being dropped through this hole is the first, cheapest wave: the attacker monetizes access immediately while figuring out what else is worth taking. And a Git server holds a lot. Source code, CI secrets, deploy keys, registry and cloud tokens, pipeline access. RCE as the service account escalates into a supply-chain and production compromise in a couple of steps. It is the same class of risk we covered in the ChainDrop npm worm, except the entry point is not a poisoned package, it is the build server itself. Treat your Git server as a Tier-0 asset and guard it like a domain controller, not like a throwaway utility.
What to do
- Upgrade to Gitea 1.27.1. Versions 1.17 and later before 1.27.1 are affected. This is the first and mandatory step, not a maintenance-window nicety.
- Disable open registration (
DISABLE_REGISTRATION = true) and take Gitea off the internet if it has no business being there: restrict by IP or put it behind a VPN. - Hunt for traces. Inspect
repositories/<user>/<repo>.git/hooks/for unexpected executables (especiallypost-receive/update); look for high-CPU processes and outbound connections to mining pools; correlate freshly created accounts and repos with the exploitation window. - Rotate deploy keys, CI secrets, and registry/cloud tokens reachable by the Gitea service account if the server was internet-facing. The patch closes the door, it does not evict who is already inside.
To find exposed services and unsafe configs before an attacker does, use external network penetration testing; to check the pipeline and the code itself, a secure code review and a container security assessment; and to map the blast radius of a compromised build host, an assumed-breach assessment. Get in touch and we will check your dev environment.
Sources: Gitea security advisory (version 1.27.1); reporting by The Hacker News, runZero, SecurityWeek; CISA KEV catalog. Vulnerable-server counts from public internet scans.