Gitea CVE-2026-60004 hits KEV: patch to 1.27.1 today

CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on August 25, which means someone is using it right now. It's a CVSS 9.8 code injection flaw in Gitea, the self-hosted Git service a lot of small teams run precisely so their source code isn't on someone else's roadmap. Anyone with write access to a repository can turn a patch upload into shell commands running as the Gitea service account. The fix has been out since July 27. If you're still on 1.27.0 or earlier, this is a today job.

What actually happened

The flaw lives in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint. Gitea applies a submitted patch inside a temporary clone; the exploit walks a patched-in file into the clone's hooks/ directory, where Git happily executes it. The Hacker News documented the chain when researcher Shai Rod (NightRang3r) disclosed it: submit the malicious patch twice to force an add/add collision, ride Git's three-way fallback (Git 2.32 and later) to check out an indexed path, land an executable at hooks/post-index-change, and get command execution the next time Git updates the index.

The proof of concept doesn't even need an outbound callback. It writes command output into Git objects, creates a branch holding the results, and the attacker reads it back over authenticated smart HTTP. Egress filtering does not save you here.

Affected: Gitea 1.17 through anything before 1.27.1. That's a range spanning years of releases. Fixed: 1.27.1, released July 27, 2026. The patch changes the temporary clone from bare to non-bare, which removes the condition that let a patched file land in the hook directory.

CISA's addition to KEV on August 25 carries a federal remediation deadline of August 28, per SecurityWeek, which also notes there were no public reports of exploitation before the KEV listing. Attribution and objectives are unknown. You are not going to get a warning shot better than this one.

Why a self-hosted Gitea flaw matters for your business

Read the exploitation requirements again, because one line does all the damage: repository write access, obtainable via default registration.

Gitea ships with open sign-up enabled. Plenty of small teams stood up an instance, pointed a subdomain at it, meant to lock registration down, and moved on to shipping. If your instance is internet-reachable with self-registration on, "attacker with repo write access" is not a privileged insider — it's whoever fills out the form and creates their own repo. The precondition collapses to zero.

What an attacker gets is worse than the source code. Shell as the Gitea service account means CI runner tokens, deploy keys, webhook secrets, database credentials in the config, and whatever else that box can reach on your internal network. A Git server is a credential concentrator by design. That's the actual blast radius.

Four things, in order:

Check your version. gitea --version, or the footer of the web UI. Anything below 1.27.1 in the 1.17+ range is affected.

Upgrade to 1.27.1 or later. Straightforward binary or container swap. Do it before you finish reading the rest of this list.

Turn off open registration if you can't patch in the next hour. DISABLE_REGISTRATION = true under [service] in app.ini. This is mitigation, not a fix — an existing low-privilege account still works — but it removes the trivial path while you schedule the upgrade.

Rotate what the box could reach. If you're patching a version that's been exposed since late July, patching alone doesn't undo access someone may already have. Rotate CI tokens, deploy keys, and any secrets stored in Gitea's config or repo variables. Then check hooks/ directories and the service account's shell history for anything you didn't put there.

We host Git for clients who have good reasons not to use GitHub — data residency, cost, a contract that says so. It's a legitimate call. The bill attached to it is that CISA's catalog is now part of your operations, and a July advisory you didn't see becomes an August incident. Someone by name should be watching the Gitea release feed and the KEV catalog. "The team" is not a name.

Sources: SecurityWeek, The Hacker News.