CVE-2026-60004 Gitea RCE Exploited in the Wild, CISA Warns

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a critical remote code execution (RCE) flaw in Gitea, a popular self-hosted Git service. The vulnerability, carrying a CVSS score of 9.8, allows any authenticated user with write access to a repository to execute arbitrary shell commands on the underlying server. Given Gitea's widespread use in DevOps pipelines and internal code hosting, this flaw poses a direct threat to software supply chains and production environments. Defenders should treat this as an emergency patching priority.

Technical Analysis

CVE-2026-60004 is a server-side template injection or command injection vulnerability that triggers when an attacker with ordinary write permissions to a repository crafts a malicious file or webhook. The flaw resides in Gitea's handling of certain Git hooks or repository settings, which fail to sanitize user-supplied input before passing it to the shell. An attacker can exploit this by pushing a specially crafted commit or modifying repository configuration, leading to code execution with the privileges of the Gitea process.

CISA's advisory, published on August 26, 2026, notes that the vulnerability is being actively exploited in the wild. The agency did not disclose specific attack campaigns or indicators of compromise, but the exploitation pattern reportedly involves dropping a miner-like payload on compromised servers, according to The Hacker News. This suggests attackers are using the RCE to hijack compute resources for cryptocurrency mining, a common post-exploitation tactic that can also signal broader network compromise.

Gitea released a patch prior to CISA's warning, but many self-hosted instances remain unpatched, especially those managed by small teams or in environments where update cycles lag. The vulnerability affects all Gitea versions prior to the patched release; administrators should verify their version and apply the latest update immediately. The exact patched version number was not specified in the available source material, so organizations should consult Gitea's official release notes for the specific version that addresses CVE-2026-60004.

Indicators of Compromise

CISA and The Hacker News did not publish specific IOCs for this campaign. However, given the reported miner payload, defenders should monitor for unusual outbound network connections to mining pools, spikes in CPU usage, and unexpected processes running as the Gitea user. Logs of repository operations, especially webhook executions or Git hook triggers, may reveal malicious activity. Without concrete hashes or IPs, network-level detection should focus on behavioral anomalies.

Tactics, Techniques & Procedures

The exploitation of CVE-2026-60004 aligns with MITRE ATT&CK technique T1059.004 (Command and Scripting Interpreter: Unix Shell), as the attacker executes arbitrary shell commands. The initial access vector is the authenticated repository write permission, which is a legitimate capability for many Gitea users, making the attack difficult to distinguish from normal activity. Post-exploitation, the attacker's use of a miner payload indicates a focus on resource hijacking, but the same access could be leveraged for data exfiltration or lateral movement.

Threat Actor Context

No specific threat actor or group has been attributed to the active exploitation of CVE-2026-60004. The lack of attribution is common in early exploitation stages, and CISA's advisory does not name a group. Defenders should not assume a low-sophistication actor based solely on the miner payload; the same vulnerability could be exploited by more advanced adversaries for other purposes.

Mitigations & Recommendations

1. Patch Immediately: Apply the latest Gitea update that fixes CVE-2026-60004. Check Gitea's official releases page for the patched version. If patching is not immediately possible, restrict write access to repositories to trusted users only, as the exploit requires write permissions.
2. Monitor for Miner Activity: Look for signs of cryptocurrency mining, such as unusual CPU usage, new processes (e.g., xmrig, kdevtmpfsi), and connections to mining pools on ports 3333, 4444, or 5555. Use endpoint detection and response (EDR) tools to alert on these behaviors.
3. Audit Gitea Logs: Review Gitea's audit logs for suspicious webhook executions or Git hook invocations that deviate from normal patterns. Pay attention to repository configuration changes made by users with write access.
4. Network Segmentation: Isolate Gitea servers from the rest of the network to limit the blast radius if an attacker gains code execution. Ensure the Gitea process runs with the least privilege necessary.
5. Review CISA KEV Catalog: Regularly check CISA's Known Exploited Vulnerabilities catalog for new additions and prioritize patching accordingly. CVE-2026-60004 is now on that list, making it a federal government requirement for civilian agencies.