CISA Confirms Active Exploitation of CVE 9.8 in Gitea, with Miners Entering via Diffpatch Endpoint

What CISA Added to the KEV

CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities Catalog on Tuesday, August 25, and the following week brought the first public confirmations of exploitation in production environments of the self-hosted Git code hosting platform Gitea. The vulnerability, with a CVSS score of 9.8, allows an attacker with write permissions on any repository to send a maliciously formatted patch to the diffpatch endpoint and plant an executable Git hook that runs arbitrary shell commands with the privilege of the Gitea process.

The flaw was patched by maintainers on July 27, with release 1.27.1, and the security notice was issued the following day. Between the disclosure and the inclusion in the KEV, independent researchers monitored automated scans on honeypots, with no public reports of actual compromise. The situation changed when a Russian administrator published a log of their own compromised instance on Habr. The report described a two-stage payload: a universal shell-loader followed by a dropper with behavior typical of cryptocurrency miners, executed within the Gitea container as the git user.

American federal agencies need to patch by Friday, August 28, a binding deadline across all infrastructure under the Federal Civilian Executive Branch. Outside of the U.S. government, CISA's guidance serves as a recommendation without a formal deadline.

Why the Flaw Affects Those Operating "Secure" Gitea

The standard practice in DevSecOps is to reduce the exposure surface of Gitea by placing the instance behind a VPN or bastion, treating the self-hosted repo as trustworthy. CVE-2026-60004 breaks this assumption on two fronts.

First, the vector requires only write access to some repository. In instances with open registration by default, a behavior that official documentation recommends for small teams, any account can create its own repository and become an authenticated attacker within seconds. The Habr report described exactly this chain: a scanner registered an account, created its own repo, triggered the exploit, wrote proof of concept back to the main branch, and initiated the dropper.

Second, the planted Git hook executes within the Gitea process, which in most installations runs as a systemd service with access to internal databases, SSH keys, and CI tokens. Escalation to the build pipeline is immediate, and those operating Gitea on Kubernetes with AWS or GCP credentials mounted via IRSA or Workload Identity are potentially exposing the entire cloud account to the same attacker who entered through the public registration.

Where the Impact Is Greatest

Gitea appears as an alternative to GitHub Enterprise for three types of clients. The first is the infrastructure team that needs to keep code within the perimeter for regulatory reasons, common among German banks under BaFin supervision and consultancies with government-adjacent contracts in the UK. The second is the Indian operation at outsourcing providers, which host repos for multiple clients under the same instance. The third is the Latin American startup that runs everything on a single VPS to contain costs.

In Germany, Gitea is the preferred platform for teams that avoid sending code to servers outside the European Union, and exposure due to CVE-2026-60004 forces a risk review in contracts that anticipate an SLA of containment within 72 hours. In the delivery hubs of TCS, Infosys, and Wipro in Pune, Bengaluru, and Manila, Gitea is one of the approved platforms for client code with air-gap policies, and a compromise in this base has effects ranging from mild to severe depending on tenant segmentation.

In Brazil, the landscape is different. Nubank, Stone, and the technology departments of major banks predominantly operate on GitHub Enterprise or GitLab, but medium-sized integrators and state technology departments still maintain Gitea instances. The practical guidance remains the same: update to 1.27.2 and audit logs since July 27.

What to Audit Before Considering It Contained

The security team that has already applied the patch needs to perform three minimum checks to rule out prior compromise. First, list all Git hooks created after July 27 in all repositories of the instance, paying attention to scripts that open network sockets or download external artifacts. Second, review the history of accounts created via open registration during that period and correlate with the immediate creation of repositories containing anomalous patches. Third, check active processes in the Gitea container against signatures of common cryptominers, starting with XMRig.

Gitea's documentation includes a fourth action that is often forgotten: disable open registration if there is no explicit reason to keep it. Instances with public signup remain the cheapest vector for external attackers to escalate, and CVE-2026-60004 is neither the first nor will it be the last to exploit this default configuration. When the next critical bug in Gitea appears, the response cost will be proportional to how many anonymous accounts remained in the database that week.