Critical RCE Vulnerability in Gitea Already Being Exploited for Cryptojacking

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported active exploitation of a critical vulnerability in the Git repository management system Gitea. The flaw in question is CVE-2026-60004 (CVSS 9.8) — a remote code execution bug that lets an attacker with ordinary write access to a repository run arbitrary shell commands as the Gitea system user.

What the problem is

According to the project's own advisory, the diffpatch endpoint can be coerced into installing and running a Git hook from repository-controlled content. The crucial catch is that with open registration enabled by default, even an unauthenticated visitor can obtain the required privileges: it's enough to create an account and set up a repository — and the necessary write access lands in the attacker's hands.

The vulnerability was discovered and reported to the developers by researcher Shai Rod (NightRang3r). The issue affects all versions of Gitea from 1.17 onward and was fixed in 1.27.1. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, requiring U.S. federal agencies to install the update by August 28, 2026.

What the real attack looked like

CISA did not disclose the details of the exploitation, but developer Andrey (@Causelof) described the incident in an article on Habr. His Gitea instance was attacked by an unknown actor who deployed a miner-like dropper. The infection came to light after a message from hosting provider HOSTKEY: the virtual server had been loading the CPU at more than 70% for an extended period, which violated the terms of service, and the provider temporarily throttled the VPS's available resources.

The culprit turned out to be an open-registration configuration: email confirmation disabled, registration via OpenID allowed, and no login required to browse. At the same time, SSH was not exposed externally — the attack came in over HTTPS. “Open registration matters here precisely because of its link to the vulnerability,” the author notes: a new user registers, creates their own repository, and gains the necessary privileges within it.

Before launching the payload, the dropper script cleared the LD_PRELOAD and LD_LIBRARY_PATH variables, looked for processes with high CPU usage, and tried to kill competitors, after which it downloaded a payload matching the architecture, ran it, and deleted the file from disk. Exactly what payload was launched could not be established — Andrey admits he did not analyze it and has no data on the mining pool, wallet, or operator. But the spike in CPU usage fits the picture of a cryptojacking campaign against vulnerable Gitea servers.

It's unclear whether the vulnerability was added to the KEV catalog specifically because of this case or whether CISA has other evidence of attacks. Owners of self-hosted Gitea instances should update to 1.27.1 as quickly as possible and review their open-registration settings.

Source: The Hacker News