Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

1. Executive summary

CVE-2026-60004 affects Gitea 1.17 through 1.27.0 and enables a repository writer to plant an executable Git hook through the diffpatch API endpoint, resulting in arbitrary shell-command execution as the Gitea service account. The supplied sources rate the vulnerability Critical, CVSS 9.8; CISA lists it as known exploited, with a remediation due date of 2026-08-28 and known ransomware use recorded as Unknown. One developer separately reported an HTTPS-originating compromise that deployed an unanalysed, miner-like payload and caused sustained CPU consumption above 70%; that post-exploitation account is single-sourced and should not be treated as representative of all exploitation. EMEA financial-services clients should urgently upgrade internet-accessible Gitea deployments to 1.27.1, particularly where users can self-register and create repositories.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

Whether an actual compromise becomes reportable under DORA, NIS2 or UK NIS 2018 depends on the affected entity’s regulatory scope and the incident’s measured operational impact; the supplied material does not establish those client-specific facts.

3. Technical analysis & attack chain

The supplied source records classify CVE-2026-60004 as Critical, CVSS 9.8, and CISA KEV-listed as actively exploited. The affected range is Gitea 1.17 through 1.27.0; the fix is included in 1.27.1. The Hacker News, SecurityWeek

Corroborated exploitation mechanics

Obtain repository write access. The vulnerable API call requires authentication and write permission to a repository. With Gitea’s default open-registration posture, an external visitor can register an account, create a repository and thereby obtain the required permission without compromising an existing account.
Submit attacker-controlled patch content. The repository writer sends a malicious patch to Gitea’s diffpatch API endpoint.
Plant an executable Git hook. The endpoint processes repository-controlled content in a manner that permits installation of the content as an executable Git hook.
Execute commands as the service account. Invocation of the planted hook runs arbitrary shell commands with the privileges of the Gitea OS service account. No privilege-escalation mechanism beyond that account is described in the supplied sources.

This mechanism is described consistently by the supplied CISA/NVD record, the initial vulnerability reporting and the exploitation reporting. NVD, The Hacker News

BSI’s summary describes exploitation by a remote anonymous attacker, whereas the more detailed sources specify authenticated repository write access. These descriptions are reconcilable where open registration lets an initially unauthenticated visitor create an account and repository before making the authenticated exploit request. BSI Germany

Reported post-exploitation activity

A single developer reported that an unknown actor exploited an exposed Gitea instance over HTTPS; Gitea’s SSH service was reportedly not internet-accessible. The instance had the following configuration:

DISABLE_REGISTRATION = false
REGISTER_EMAIL_CONFIRM = false
ENABLE_OPENID_SIGNUP = true
REQUIRE_SIGNIN_VIEW = false

The reported dropper then:

Cleared LD_PRELOAD and LD_LIBRARY_PATH.
Searched for processes consuming substantial CPU resources.
Attempted to terminate competing processes.
Selected and fetched a payload according to system architecture.
Wrote the payload to disk and executed it.
Deleted the downloaded file after execution.

The hosting provider detected sustained CPU utilisation above 70% and temporarily restricted the VPS’s available CPU capacity. This resource consumption is consistent with mining, but the payload was not analysed: no miner family, mining pool, wallet or operator was confirmed. There is consequently insufficient evidence to classify the activity definitively as cryptojacking.

No persistence mechanism, privilege escalation, command-and-control infrastructure, lateral movement, repository modification, data access or exfiltration was identified in the supplied account. CISA has not disclosed whether this incident caused the KEV listing or whether other exploitation clusters exist.

The post-exploitation sequence and configuration are single-sourced; verify before enforcement. The actor is unknown, no supporting MITRE profile was supplied, and attribution remains unconfirmed. The Hacker News

CVE-2026-60004 should not be conflated with the separately reported Gitea vulnerabilities CVE-2026-20896 or CVE-2026-59774.

4. Mitigation & containment

P1 — within 24 hours

Inventory all Gitea deployments and identify versions 1.17 through 1.27.0. Upgrade affected instances to Gitea 1.27.1. The supplied KEV record gives a remediation due date of 2026-08-28.
Until upgraded, remove affected instances from direct internet access or restrict them to trusted administrative networks/VPNs. Restrict external access to the diffpatch API endpoint at the reverse proxy where operationally feasible.
Disable public account creation by setting:

DISABLE_REGISTRATION = true
ENABLE_OPENID_SIGNUP = false

These are exposure-reduction measures, not substitutes for upgrading.

If exploitation is suspected, isolate the Gitea host, restrict outbound connectivity and preserve volatile process, network, application, reverse-proxy and authentication evidence before terminating suspicious processes.
Review recently created users and repositories. Prioritise accounts that registered externally, immediately created a repository and then accessed the diffpatch endpoint.

P2 — within 72 hours

Search HTTPS, reverse-proxy and Gitea logs for diffpatch requests associated with new or unexpected accounts.
Review Git hooks in repositories created or modified by those accounts. Investigate hooks that result in shell or downloader execution under the Gitea service identity.
Examine process telemetry for the Gitea service account spawning shell commands, clearing LD_PRELOAD or LD_LIBRARY_PATH, enumerating CPU-intensive processes, terminating processes, downloading an architecture-specific executable, and deleting it after execution.
Review CPU telemetry for unexplained sustained utilisation, including usage above 70%, while recognising that this threshold derives from one incident and is not a universal exploit signature.
Where command execution is confirmed, rebuild or otherwise remediate the affected host from a trusted state. Rotate credentials and keys available to the Gitea service account according to the exposure established by local investigation.

P3 — within 7 days

Keep self-registration disabled where it is not operationally required. If it must remain available, enable email verification with REGISTER_EMAIL_CONFIRM = true and restrict OpenID sign-up to a controlled identity path.
Consider REQUIRE_SIGNIN_VIEW = true to reduce anonymous exposure; this does not remediate CVE-2026-60004.
Alert on unusual repository creation followed by diffpatch access and child-process execution by the Gitea service.
Retrospectively review available logs across the period during which a vulnerable Gitea version was externally reachable.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The reported payload URL, filename, hash, mining pool, wallet and infrastructure were not supplied.

Behavioural indicators

behaviour	where to observe	confidence
Newly registered account creates a repository and then accesses the `diffpatch` endpoint over HTTPS	Gitea audit, authentication, API and reverse-proxy logs	High for exploit mechanics; observed case single-sourced
Executable Git hook causes shell commands to run as the Gitea service account	Repository hook review, EDR and process telemetry	High
Clearing of `LD_PRELOAD` and `LD_LIBRARY_PATH` before payload execution	EDR, shell audit and process telemetry	Low–medium; single-sourced
Enumeration and attempted termination of CPU-intensive competing processes	EDR and process telemetry	Low–medium; single-sourced
Architecture-dependent payload download, execution and subsequent deletion	EDR, network, filesystem and process telemetry	Low–medium; single-sourced
Sustained CPU utilisation above 70%	Host and infrastructure monitoring	Low; non-specific and single-sourced

6. Detection

No YARA rule is supportable from the supplied material because no payload bytes, threat-specific file content, filename, path, command line, mutex or other sufficiently distinctive static artefact was provided.

The following Sigma rule identifies access to the affected endpoint. It is intentionally broad and should be correlated with new-account registration, repository creation, Git-hook changes and Gitea service-account child processes.

title: Potential Gitea diffpatch Endpoint Exploitation
status: experimental
description: Detects web requests to the Gitea diffpatch endpoint associated with CVE-2026-60004 exploitation.
references:

  - https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60004
author: Adverse Trace
date: 2026-08-26
logsource:
  category: webserver
detection:
  selection:
    url|contains: 'diffpatch'
  condition: selection
falsepositives:

  - Legitimate authenticated repository patch activity
level: medium

7. Sources

The Hacker News, “Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload,” https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html, 2026-08-26.
The Hacker News, “New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands,” https://thehackernews.com/2026/07/new-gitea-rce-lets-repository-writers.html, July 2026.
SecurityWeek, “CISA Warns of Exploited Gitea Vulnerability,” https://www.securityweek.com/cisa-warns-of-exploited-gitea-vulnerability/, date not provided in supplied material.
NIST NVD, “CVE-2026-60004,” https://nvd.nist.gov/vuln/detail/CVE-2026-60004, date not provided in supplied material.
BSI Germany, “[NEU] [hoch] Gitea: Schwachstelle ermöglicht Codeausführung,” https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2557, date not provided in supplied material.

8. Adverse Trace position

CVE-2026-60004 is source-rated Critical, CVSS 9.8, and CISA KEV-listed as actively exploited, with ransomware use Unknown; affected Gitea deployments therefore warrant immediate P1 remediation to version 1.27.1. Internet exposure combined with open registration materially lowers the access barrier by allowing an external actor to create the repository for which write permission is required. The reported miner-like payload and associated behaviours remain single-sourced; verify before enforcement, and do not infer ransomware or a specific mining operation from CPU consumption alone. Attribution is unconfirmed. Adverse Trace will monitor for vendor or CISA technical updates, independently corroborated exploitation patterns and actionable infrastructure or payload indicators.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.