Gitea Self-Hosted Git Service Unauthenticated RCE Actively Exploited to Deploy Cryptocurrency Miners (CVE-2026-60004)

Scope: Gitea Versions 1.17 through 1.27.0 (All Versions Prior to 1.27.1)

Severity: Red

CVE-2026-60004 (CVSS 9.8) is a critical remote code execution vulnerability in Gitea's diffpatch endpoint that allows an attacker with repository write access to install and execute arbitrary Git hooks containing shell commands, running as the Gitea OS user on the underlying server. Because Gitea enables open user registration by default, this effectively gives any unauthenticated visitor a direct path to RCE: register an account, create a repository, push a malicious patch, and trigger hook execution. CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed, with at least one documented incident in which a victim's hosting provider flagged sustained high CPU usage caused by a cryptocurrency miner deployed via this vulnerability. Organizations must update to Gitea version 1.27.1 immediately, disable open registration where not operationally required, and audit all existing repositories for unauthorized Git hooks as indicators of prior compromise.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.