Hackers Exploit Critical Gitea Flaw to Run Commands and Deploy Cryptomining Malware

Hackers discovered a flaw in Gitea that enabled them to penetrate servers and are actively exploiting it. The bug, CVE-2026-60004, has the highest CVSS rating of 9.8. This suggests how much of a risk this bug poses to Gitea users.

CISA announced that the bug is now on its Known Exploited Vulnerabilities list, suggesting there’s sufficient evidence of active exploits. However, CISA has yet to mention who’s behind these attacks or share more details.

A separate report shows how the flaw can be used. A developer known as Andrey, or @Causelof, said an unknown attacker hit his Gitea server. The attacker used the flaw to run a dropper. Its actions looked like those of a crypto-mining tool. The report did not name the final file or who ran the attack.

What Makes this Vulnerability Dangerous

CVE-2026-60004 is a flaw in Gitea’s diffpatch feature. It affects versions 1.17 up to 1.27.0. Gitea’s version 1,27.1 has fixed the problem. However, in Gitea’s own notice, the company described the flaw as critical. They assigned it a 9.8 CVSS score. The notice credits security researcher Shai Rod, also known as NightRang3r, with finding and reporting the flaw.

The diffpatch feature handles patches sent to a repo. A user with write access can send a crafted patch. The bug can make Git place a hook that can run code inside the repo.

The hook can then run shell commands as the Gitea user. This turns normal repo access into a way to run code on the server. An attacker does not need admin rights.

Open registration makes the risk worse. Gitea’s default settings allow users to register accounts. A new user can then create a repo and gain the write access needed for the attack.

So an open Gitea site can face attack from anyone on the web. The flaw also needs no user click or other action after the attacker reaches the vulnerable path. That makes a public server an easier target.

Gitea changed how it handles the temp repo used for patches. The old code used a bare repo. The fix uses a normal repo with a work tree.

Reported Attack Came Through HTTPS

Andrey’s report shows how one attack worked. His Gitea setup allowed open signup. It did not need email checks for new accounts. OpenID signup was on, and people could view the site without a sign-in.

The server did not expose Gitea SSH to the web. The attack came through HTTPS. The issue came to light after a warning from HOSTKEY. The host said the virtual server used more than 70% of its CPU for a long time.

HOSTKEY then cut the server’s CPU use. Andrey traced the spike to the Gitea server. He linked the activity to CVE-2026-60004. He also said the attacker went from account signup to the exploit in about 11 seconds.

That gap may point to an automated attack. But it is one case, so it does not show that all attacks work this way.

The Dropper may Point to Cryptojacking

After the exploit, the attacker ran a dropper on the server. The script first cleared LD_LIBRARY_PATH & LD_PRELOAD. It then looked for apps using a lot of CPU. Also, it tried to stop other apps that used CPU. It then got a file made for the server’s CPU type. Then it saved the file, ran it, and then deleted it.

The final program remains unknown. Andrey did not study it, so the mining pool, wallet, miner and threat group are not known.

Still, the high CPU use and the dropper look like cryptojacking. In such attacks, criminals use a victim’s server to mine crypto. The finding has limits. It points to a miner-like job, but it does not name the miner or its owner.

CISA Sets an August 28 Deadline

CISA has not said if the HOSTKEY case led to the KEV listing. It may have other proof of attacks on weak Gitea servers.

U.S. federal agencies must fix the flaw by August 28. Gitea users should act now. Admins need to quickly update to Gitea 1.27.1 or later. They should also ask if public signup is needed. If not, they can turn it off.

The urgency of CISA’s warning reflects a broader pattern of attackers using legitimate platforms to hide malicious activity. In the Middle East, the TELESHIM backdoor abuses Telegram API for C2 communication, using it to download next-stage payloads and execute reconnaissance commands. Gitea lists DISABLE_REGISTRATION as false by default.

Teams should check logs for new accounts, odd repo use, and odd diffpatch calls. They should also check for new Git hooks, unknown apps and CPU spikes. CVE-2026-60004 shows how a simple repo tool can open a path into a server. CISA now lists it as exploited, so exposed Gitea sites need a fast patch.