SECURITY

Gitea CVE-2026-60004 Is Being Exploited and the Patch Deadline Is Tomorrow

27 August 2026 · 4 min read · By Future Technology

Key takeaways

CVE-2026-60004 is a CVSS 9.8 code injection in Gitea's diffpatch API endpoint, letting an attacker run shell commands as the Gitea service account
Every version from 1.17 onward is affected. Gitea 1.27.1 contains the fix
CISA added it to the KEV catalogue on 25 August with a 28 August deadline for US federal civilian agencies
Exploitation needs repository write access, which is a much lower bar on a self-hosted instance with old contributors still on the list

CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue on 25 August and gave US federal civilian agencies until 28 August to fix it. That is tomorrow. If you run a self-hosted Gitea instance, you do not have a federal deadline, but you do have the same flaw.

What CVE-2026-60004 in Gitea actually does

It is a code injection in Gitea's diffpatch API endpoint, scored CVSS 9.8. The attack chain is short. An attacker with ordinary write access to a repository sends a crafted patch, plants an executable Git hook, and from there runs shell commands as the Gitea service account.

Every version from 1.17 onward is affected. Version 1.27.1 fixes it.

Note the shape of this one, because it changes how worried you should be. This is not an unauthenticated worm crawling the internet. It needs repository write access. On a corporate instance with tight access control that is a real barrier. On a self-hosted box where you handed commit rights to a contributor two years ago, or a client, or a former colleague whose account nobody removed, it is much lower than it sounds. At least one reported attack ended with a dropper behaving like a crypto miner.

The three question check

Run these now, in order.

Are you on Gitea 1.17 or newer and below 1.27.1? If yes, you are affected. Check with gitea --version or the footer of your instance's web UI.
Who currently has write access to any repository on that instance? Not who should have it. Who has it. Anyone on that list you would not hand a shell to is a live path to this bug.
Have you checked .git/hooks on your repositories for anything you did not put there? A planted hook is the persistence mechanism, so a patch alone does not clean up an instance that was already hit.

Upgrading to 1.27.1 closes the door. Auditing your collaborator list and hooks tells you whether anyone came through it first.

Why self-hosters keep getting caught by this pattern

Self-hosted Git is the default now for anyone who wants their code off someone else's server, and that is a reasonable choice. It just moves the patching burden onto you, permanently. A CVSS 9.8 with a three day federal deadline is exactly the kind of thing a one-person instance misses, because there is no security team sending the email.

August has been busy on this front. CISA's August 2026 KEV additions already included a 9.8 macOS Screen Sharing bypass and a 9.1 in SharePoint. Before that came the Keycloak flaw CVE-2026-18963 and an actively exploited Zimbra bug. The common thread is not that self-hosted software is worse. It is that the update does not install itself.

If you run anything on your own hardware, the practical fix is not vigilance, which fails, but a calendar entry. Once a month, check versions on everything you host and read the KEV catalogue. It takes twenty minutes and it is the difference between patching on the deadline and finding out from your electricity bill.