Over 8,300 internet-exposed Gitea instances remain unpatched against a critical security flaw now being actively exploited in remote code execution attacks, according to Internet security watchdog Shadowserver. The vulnerability, tracked as CVE-2026-60004, allows authenticated attackers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches through the diffpatch API endpoint.

How Attackers Exploit This Flaw

The code injection vulnerability was discovered and reported by Salesforce security researcher Shai Rod. While exploitation technically requires repository write access, Gitea's default configuration leaves most instances wide open—self-registration is enabled out of the box. "An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user," Gitea's own security team confirmed. "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository." This means anyone can spin up an account, create a repo, and immediately start exploiting vulnerable servers without needing stolen credentials.

The Scale of Exposure

Shadowserver's scanning revealed 8,393 unique IP addresses running vulnerable Gitea instances as of August 27. The organization announced it had begun "scanning/reporting Gitea instances vulnerable to CVE-2026-60004 (code injection)" in a public advisory. Given that Gitea is designed for self-hosting and powers internal development pipelines, CI/CD systems, and private code repositories across thousands of organizations, this exposure represents a serious supply chain risk.

CISA Issues Emergency Directive

The U.S. Cybersecurity and Infrastructure Security Agency escalated its response on Tuesday by adding CVE-2026-60004 to its catalog of actively exploited vulnerabilities. Federal Civilian Executive Branch agencies were given just three days—by August 28—to patch affected servers under Binding Operational Directive 26-04. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned in its advisory.

Cryptocurrency Miners Targeting Unpatched Servers

While CISA has not published detailed technical intelligence on the ongoing attacks, the decision to fast-track remediation suggests evidence of active exploitation. Industry reporting indicates threat actors are deploying cryptocurrency mining malware onto compromised Gitea servers. For infrastructure teams running these instances, this isn't just about patching a software vulnerability—it's about preventing your build servers from becoming crypto-jacking zombies.

A Pattern of Gitea Vulnerabilities

This isn't the first time Gitea has faced critical flaws this year. In July, researchers identified CVE-2026-20896, an authentication bypass vulnerability in the official Gitea Docker image affecting instances with reverse proxy authentication headers enabled. The rapid succession of severe vulnerabilities is raising questions about Gitea's security development lifecycle, particularly given its role as a self-hosted alternative to cloud platforms like GitHub and GitLab.

What Is Gitea?

Gitea positions itself as a lightweight, self-hosted Git service—a privacy-focused alternative for organizations uncomfortable with storing source code on third-party platforms. The project has accumulated over 400,000 installations worldwide with nearly 1,500 contributors to its open-source codebase. Version 1.27.1, released July 27, addresses CVE-2026-60004 and remains the only patched release available.

Key Takeaways

  • Upgrade immediately: Gitea 1.27.1 is the minimum patched version for this vulnerability
  • Disable self-registration if you can't patch right now—this blocks the easiest exploitation path
  • Check your firewall rules: Only 8,393 servers are exposed, but that's still thousands of potential entry points
  • Watch for crypto mining processes on Gitea hosts—it's likely already happening at scale

The Bottom Line

If you're running Gitea and haven't patched in the last month, assume you've been compromised. This vulnerability requires no zero-days, no sophisticated tooling—just an attacker registering a free account on your public instance. Patch now, disable registration if you must delay, and check your system monitoring for unexpected computational load.