Loading story…
Gitea has patched a critical remote code execution flaw, CVE-2026-60004, affecting versions 1.17 through 1.27.0, after researchers showed that attacker-controlled patch content sent to the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint could be turned into a malicious Git hook and executed as the Gitea service account. The bug carries a CVSS 9.8 rating and stems from patch application inside a shared bare temporary clone, where Git's three-way fallback can activate the planted hook; exploitation also depends on Git 2.32 or later. Gitea fixed the issue in version 1.27.1 and said its cloud instances would be upgraded automatically.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public proof-of-concept exploit code exists for the Gitea vulnerability, increasing the risk of exploitation on exposed instances. Gitea's advisory said it had not observed in-the-wild exploitation as of July 29, 2026.
Gitea patched a critical remote code execution vulnerability, CVE-2026-60004, affecting versions 1.17 through 1.27.0/ before 1.27.1. The flaw allows a repository writer to turn crafted patch content into a malicious Git hook and execute shell commands as the Gitea service account.
A ProjectDiscovery Nuclei template for detecting CVE-2026-60004 in Gitea was developed and then corrected after false positives were found on patched versions. The update consolidated matcher conditions with && and added flow logic so the sign-up page check runs only after a vulnerable version is identified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcerunzero.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Gitea authorization bypass tracked as **`CVE-2026-58443`** allows a **public-only** access token with **`write:repository`** scope to push commits into a private repository under specific pull request conditions. The flaw affects Gitea releases up to and including **`v1.26.4`** and was fixed in **`v1.27.0`**. Researchers said the issue lies in the pull request update endpoint, where Gitea checks the token’s public-only restriction against the public base repository but fails to enforce that restriction again when operating on the private head repository. The bug can be abused to perform unauthorized server-side merges or rebases into a private pull request head branch, and those writes may also trigger **Gitea Actions** workflows on the private repository if Actions is enabled. Public reporting included a technical analysis and a working proof-of-concept, though no confirmed in-the-wild exploitation was cited. Administrators were urged to upgrade to **`v1.27.0`**, audit and rotate or revoke public-only tokens with write permissions, review public-to-private pull request relationships, and inspect recent private repository pushes and Actions logs for suspicious activity.
Jul 21, 2026
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
Rapid7 and BleepingComputer reported an unpatched **zero-day** in the self-hosted Git service **Gogs** that allows **authenticated remote code execution** through argument injection in the pull request rebase workflow. The flaw affects current releases including `0.14.2` and `0.15.0+dev`, and likely earlier versions that support rebase merging. An attacker can abuse the **"Rebase before merging"** feature by supplying a malicious branch name that is passed into a `git rebase` command without a proper option separator, enabling use of Git's `--exec` flag to run attacker-controlled shell commands as the Gogs server process user. The issue is rated **CVSSv4 9.4** and is considered especially dangerous on default-configured instances because **open registration** and unrestricted repository creation are enabled by default, lowering the barrier to exploitation. Successful attacks could expose private repositories, stored credentials, and secrets, enable code tampering and supply-chain compromise, and support lateral movement deeper into victim networks. Rapid7 said no vendor patch was available at publication time and released a Metasploit module for Linux and Windows, while separate reporting noted Gogs maintainers had only acknowledged the report. The disclosures follow broader scrutiny of Git hosting platforms, including a recently disclosed **Gitea** flaw, `CVE-2026-27771`, that can expose private container images without authentication on versions prior to `1.26.2`.
Jun 29, 2026