CISA Orders Federal Agencies to Patch Critical Gitea Flaw Under Active Attack

The Cybersecurity and Infrastructure Security Agency on Tuesday ordered federal civilian agencies to patch a critical flaw in Gitea, an open-source software development platform used by companies and government offices to host their own private code repositories, after confirming that hackers are actively exploiting it. The vulnerability lets an attacker with only ordinary write access to a code repository run arbitrary commands on the server that hosts it, and on Gitea's default configuration, that access can be obtained simply by signing up for an account.

CISA added the flaw, tracked as CVE-2026-60004, to its Known Exploited Vulnerabilities catalog on August 25, giving federal agencies until August 28 to secure or disconnect affected systems. Gitea's maintainers had quietly patched the bug five weeks earlier, but the fix went largely unnoticed until security researchers traced a live intrusion back to it this week.

The scope of the exposure

The vulnerability carries a maximum-severity rating of 9.8 out of 10 on the industry's Common Vulnerability Scoring System. It lives in Gitea's "diffpatch" feature, the mechanism the platform uses to apply a code patch to a repository. By crafting a malicious patch, an attacker can plant an executable Git hook — a script that Git automatically runs at certain points in its workflow — and have it fire with the privileges of the Gitea service account itself.

The cybersecurity monitoring service Shadowserver has counted nearly 5,000 Gitea instances reachable from the open internet, according to reporting by BleepingComputer, though it is not clear how many of those have already been patched or are decoy systems set up by researchers. The bug affects every Gitea release going back to version 1.17, meaning installations that have not been upgraded in years are exposed. Gitea shipped the fix, version 1.27.1, on July 27; a further update, 1.27.2, followed shortly after.

Gitea is a lightweight alternative to GitHub or GitLab that organizations run on their own servers rather than in the cloud, giving them full control over their source code. That self-hosted model is also what makes a flaw like this one dangerous: unlike a vulnerability in a centrally managed cloud service, patching depends on thousands of individual administrators noticing the advisory and acting on it.

The flaw was reported to Gitea's maintainers by Shai Rod, a security researcher at Salesforce, according to BleepingComputer. In its security advisory, Gitea's team laid out just how little an attacker needs to succeed:

"An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user," the maintainers wrote, as quoted by Help Net Security. "This is remote command execution as the Gitea service account. With open registration enabled, the attack can be performed by an unauthenticated visitor after registering a normal account and creating a repository." Because Gitea ships with self-registration turned on by default, that describes most installations that administrators have not deliberately locked down.

Successful exploitation can expose a server's main configuration file, environment secrets, database credentials and any OAuth tokens tied to connected services, according to the advisory — a foothold that could extend well beyond the code repository itself into the software supply chain it feeds.

Who is affected, and what an attack looks like

Gitea is popular with small and mid-size engineering teams, universities, and government IT shops that want the collaborative features of GitHub without handing their source code to an outside cloud provider. That audience overlaps heavily with organizations that CISA is required to protect, which is why the agency's Known Exploited Vulnerabilities catalog — and the three-day remediation clock that comes with it for federal agencies under Binding Operational Directive 26-04 — applies here.

A real-world case documented on the Russian technical blog Habr, and summarized by Help Net Security, shows how fast the attack chain moves. A developer whose hosting provider flagged unusually high CPU usage on a virtual server found that an automated scanner had registered an account on their outdated, unpatched Gitea instance — which had open registration enabled with no CAPTCHA or email verification — created a repository, and triggered the exploit. The intruder wrote a "proof" of code execution into a Git branch, then downloaded a generic shell-loader followed by a cryptocurrency-mining payload. By the developer's account, the active portion of the attack lasted about 11 seconds. Because the Gitea process ran inside an unprivileged Docker container, the miner did not survive a restart and investigators found no evidence of persistence through cron jobs, systemd services or new SSH keys — a narrow escape that a differently configured server might not have gotten.

Reaction, and a pattern of Gitea flaws

CISA's public alert struck its now-familiar note of urgency about self-hosted developer infrastructure.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the agency said, adding that while its binding directive applies only to federal civilian agencies, it "encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

This is not the first Gitea vulnerability to draw that kind of warning this year. In July, researchers separately disclosed active exploitation of CVE-2026-20896, an authentication-bypass bug affecting Gitea servers that rely on reverse-proxy headers for login, which as of this week has not itself been added to the KEV catalog. Earlier in the year, a separate flaw left private container images in more than 30,000 Gitea-based deployments readable without authentication for roughly four years before it was patched. Taken together, security researchers say the recurring issues point to the strain that comes with running critical developer infrastructure on a smaller, community-driven open-source project rather than a heavily resourced commercial platform.

What happens next

For now, the immediate deadline applies only to U.S. federal civilian agencies, which must patch or isolate vulnerable Gitea servers by August 28. CISA's guidance to everyone else is more of a strong recommendation than a mandate: update to Gitea 1.27.2 or later, and treat any unpatched instance that allowed open self-registration as potentially compromised rather than simply at risk. Administrators who cannot patch immediately are advised to disable open registration, add email confirmation or a CAPTCHA to signups, and review logs for unfamiliar repositories or recently created accounts.

CISA has not said who is behind the exploitation it observed, and the agency's KEV entry does not describe the attacks in detail. The cryptocurrency-mining activity documented so far suggests financially motivated, largely automated scanning rather than a targeted campaign, but security researchers caution that the same access an attacker needs to install a miner — a foothold on a code hosting server with visibility into private repositories and credentials — would also be sufficient for more damaging supply-chain attacks, including tampering with the software that a compromised organization ships to its own customers.