CVE-2026-60004
Gitea Code Injection Vulnerability
Description
CVE-2026-60004 is a critical code injection vulnerability that allows unauthenticated remote code execution in Gitea, the self-hosted Git service. Versions before 1.27.1 permit code execution via the diffpatch API through Git hook installation: an attacker reaches the API path without credentials and causes a Git hook to be installed, and because Git hooks are scripts the server executes automatically during repository operations, the attacker's code runs on the Gitea host. Gitea is affected from 1.17.0 up to 1.27.1. Because a Gitea instance holds an organisation's source code, CI secrets and deployment keys, CVE-2026-60004 is a supply-chain-grade vulnerability; it carries a CVSS score of 9.8, an extraordinary EPSS score of roughly 87% at the 99th percentile, public exploit code, and a CISA Known Exploited Vulnerabilities (KEV) listing.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gitea | gitea | >= 1.17.0, < 1.27.1 |
References
- https://blog.gitea.com/release-of-1.27.1/(Release Notes)
- https://github.com/0xBlackash/CVE-2026-60004(Exploit, Mitigation, Third Party Advisory)
- https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m(Exploit, Vendor Advisory)
- https://www.runzero.com/blog/gitea/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when software constructs all or part of a code segment from externally influenced input without neutralising elements that change the syntax or behaviour of the intended code. In CVE-2026-60004 the injected artefact is a Git hook: attacker-controlled content is written into a hook script that Gitea's own Git operations subsequently execute, so the attacker does not need to find an execution sink at request time — the repository machinery runs the code for them.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2026-60004 is remotely exploitable over the network with low attack complexity, no authentication and no user interaction — reaching the Gitea HTTP interface is the entire precondition, and self-hosted Gitea instances are commonly exposed so that developers and CI systems can reach them. The impact is high across confidentiality, integrity and availability: code execution on a Gitea host exposes every repository it serves along with access tokens, deploy keys, webhook secrets and CI credentials, allows the attacker to modify source code and commit history that downstream builds consume, and permits the service to be destroyed. The supply-chain consequence is what makes this worse than a single server compromise — a backdoor committed into a widely used internal repository propagates into builds and production deployments carrying the organisation's own trust. The CVSS 3.1 base score is 9.8 (Critical), and the EPSS score of approximately 87% in the 99th percentile is among the highest values assigned to any vulnerability, indicating essentially continuous exploitation attempts.
Exploit Maturity
CVE-2026-60004 sits at the extreme end of exploit maturity. Public exploit code is available in a dedicated GitHub repository for CVE-2026-60004, tagged as exploit material, and the vendor's own advisory GHSA-rcr6-4jqh-j84m is likewise tagged as exploit reference, so both a working tool and an authoritative technical description are freely obtainable. CISA has confirmed active exploitation through its KEV listing with a deadline of 28 August 2026 that has passed, and runZero has published research on exposed Gitea instances. The decisive figure is the EPSS score of roughly 87%, in the 99th percentile — among the very highest exploitation probabilities recorded, meaning attacks are effectively continuous against any reachable instance. There is no realistic scenario in which an internet-exposed unpatched Gitea server has escaped attention; treat such systems as compromised and investigate accordingly.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with the vendor's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 28 August 2026 has passed.
- Upgrade Gitea to 1.27.1 or later. All versions from 1.17.0 up to 1.27.1 are affected; the 1.27.1 release announcement and the vendor advisory GHSA-rcr6-4jqh-j84m document the fix.
- Remove the instance from internet exposure right now. With a public exploit, an EPSS score near 87% and no authentication requirement, an internet-facing unpatched Gitea instance is being attacked continuously — place it behind a VPN or IP allowlist immediately, before and independently of the upgrade.
- Assume compromise and audit repositories and hooks thoroughly. Inspect every repository's
hooksdirectory on the server for scripts nobody installed, review commit history for unexpected commits and force-pushes, check for new admin users, access tokens, OAuth applications, webhooks and deploy keys, and verify the host for unfamiliar processes, cron entries and outbound connections. runZero's write-up on Gitea provides context on identifying exposed instances. - Rotate every secret the instance touched and harden long term. Revoke and reissue all Gitea access tokens, OAuth client secrets, webhook secrets, deploy keys and any CI/CD credentials stored in or reachable from repositories, and require developers to re-authenticate; then enforce signed commits and branch protection so that injected commits fail verification, restrict who may enable Git hooks at all, and keep self-hosted developer platforms behind authenticated ingress as a standing rule.
Technical Details
CVE-2026-60004 is a code injection flaw (CWE-94) in Gitea's diffpatch API. The API path is reachable without authentication in affected versions, and the request handling allows attacker-supplied content to result in the installation of a Git hook on the server. Git hooks are executable scripts stored inside a repository's hooks directory that Git runs automatically at defined points in repository operations — before a push is accepted, after a commit is received, and so on — so installing one is equivalent to scheduling arbitrary code for execution in the Gitea service context. The attacker therefore never needs a direct execution primitive in the request itself; the injected code executes when the server performs normal repository work. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H records an unauthenticated, low-complexity network attack with no user interaction and full impact on confidentiality, integrity and availability at unchanged scope. Gitea's own security guidance has long treated Git hook access as an administrator-only capability precisely because it is equivalent to shell access, which is what makes an unauthenticated path to hook installation so severe.
Frequently Asked Questions
Is CVE-2026-60004 being actively exploited?
Yes, continuously. CISA lists CVE-2026-60004 in its Known Exploited Vulnerabilities catalog with a remediation deadline of 28 August 2026 that has passed, public exploit code is published on GitHub, and the vendor advisory itself is tagged as exploit material. Its EPSS score of about 87% sits in the 99th percentile, among the highest ever assigned.
What products are affected by CVE-2026-60004?
Gitea is affected in all versions from 1.17.0 up to but excluding 1.27.1. The vulnerable path is the diffpatch API, which in affected versions can be reached without authentication and used to install a Git hook that the server then executes.
How do I fix CVE-2026-60004?
Upgrade Gitea to version 1.27.1 or later as described in the 1.27.1 release notes and advisory GHSA-rcr6-4jqh-j84m, and immediately restrict the instance to trusted networks. Because unauthenticated code execution was possible, also audit every repository's hooks directory and commit history, rotate all tokens, deploy keys, webhook secrets and CI credentials, and check the host for persistence.
How severe is CVE-2026-60004?
CVE-2026-60004 is Critical with a CVSS 3.1 base score of 9.8. It is unauthenticated, network-exploitable with low complexity and no user interaction, and yields remote code execution on a server holding an organisation's source code and CI secrets, with full confidentiality, integrity and availability impact; with public exploit code and an EPSS score in the 99th percentile, it is among the most urgent vulnerabilities currently outstanding.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.