Attackers Actively Exploit Critical Gitea RCE Flaw as CISA Adds It to KEV Catalog With August 28 Deadline

Overview

A critical remote code execution flaw in Gitea, the self-hosted Git platform, is now under active exploitation, with attackers deploying cryptocurrency mining malware on unpatched servers, according to BleepingComputer. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability, tracked as CVE-2026-60004, to its Known Exploited Vulnerabilities catalog on August 25, 2026, setting a due date of August 28, 2026, for federal agencies to apply mitigations, according to CISA’s KEV data feed.

The flaw itself is not new: Gitea patched it in version 1.27.1 on July 27, and it was previously reported by The Machine Herald at the time of disclosure, when no source indicated the bug had been exploited in the wild. The new developments are the confirmed exploitation and the federal patch mandate.

What We Know

• CVE-2026-60004 lets an attacker with ordinary repository write access execute arbitrary shell commands as the Gitea service account, according to the GitHub security advisory for the flaw. The advisory rates it 9.8 out of 10 on the CVSS 3.1 scale, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and lists affected versions as 1.17 up to but not including 1.27.1.
• The advisory describes the exploitation mechanism directly: “Git invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.”
• Because Gitea ships with self-registration enabled by default, an unauthenticated visitor can sign up, create a repository, and obtain the write access the exploit requires without any prior credentials, BleepingComputer reports.
• BleepingComputer reports that attackers have deployed cryptocurrency mining malware on unpatched, internet-exposed Gitea servers, and that the security research group Shadowserver tracks nearly 5,000 internet-exposed Gitea instances, though the outlet notes it is unclear how many of those are honeypots or already patched.
• CISA’s KEV catalog entry, titled “Gitea Code Injection Vulnerability,” lists a dateAdded of August 25, 2026, and a dueDate of August 28, 2026, and directs agencies to apply mitigations “in accordance with vendor instructions,” citing compliance with Binding Operational Directive 26-04, according to CISA’s KEV data feed.

What We Don’t Know

• Gitea’s own security advisory for CVE-2026-60004 does not mention active exploitation, malware, or a CISA KEV designation — those details come from BleepingComputer’s reporting and CISA’s catalog addition, not from an update to the advisory itself.
• It is not disclosed how many of the roughly 5,000 internet-exposed Gitea instances Shadowserver tracks remain unpatched, nor how many have already been compromised.
• Neither source specifies the exact cryptomining malware family deployed in the observed attacks.

Analysis

The gap between disclosure and exploitation illustrates a recurring pattern in self-hosted developer infrastructure: Gitea shipped the fix a full month before CISA’s KEV addition, yet the same default configuration choice flagged in the original disclosure — open self-registration granting the write access the exploit requires — appears to have left a meaningful population of internet-facing instances exploitable long enough for opportunistic cryptomining campaigns to find them.