Loading story…
Gitea has patched a critical remote code execution flaw, CVE-2026-60004, affecting versions 1.17 through 1.27.0, after researchers showed that attacker-controlled patch content sent to the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint could be turned into a malicious Git hook and executed as the Gitea service account. The bug carries a CVSS 9.8 rating and stems from patch application inside a shared bare temporary clone, where Git's three-way fallback can activate the planted hook; exploitation also depends on Git 2.32 or later. Gitea fixed the issue in version 1.27.1 and said its cloud instances would be upgraded automatically.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
MITRE published and updated the CVE-2026-60004 record, classifying the Gitea diffpatch API Git-hook issue as CWE-94 code injection with a CVSS v3.1 score of 9.8. The record states that Gitea versions 1.17 through before 1.27.1 are affected and that 1.27.1 fixes the issue.
Public proof-of-concept exploit code exists for the Gitea vulnerability, increasing the risk of exploitation on exposed instances. Gitea's advisory said it had not observed in-the-wild exploitation as of July 29, 2026.
Gitea patched a critical remote code execution vulnerability, CVE-2026-60004, affecting versions 1.17 through 1.27.0/ before 1.27.1. The flaw allows a repository writer to turn crafted patch content into a malicious Git hook and execute shell commands as the Gitea service account.
A ProjectDiscovery Nuclei template for detecting CVE-2026-60004 in Gitea was developed and then corrected after false positives were found on patched versions. The update consolidated matcher conditions with && and added flow logic so the sign-up page check runs only after a vulnerable version is identified.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcerunzero.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Gitea authorization bypass tracked as **`CVE-2026-58443`** allows a **public-only** access token with **`write:repository`** scope to push commits into a private repository under specific pull request conditions. The flaw affects Gitea releases up to and including **`v1.26.4`** and was fixed in **`v1.27.0`**. Researchers said the issue lies in the pull request update endpoint, where Gitea checks the token’s public-only restriction against the public base repository but fails to enforce that restriction again when operating on the private head repository. The bug can be abused to perform unauthorized server-side merges or rebases into a private pull request head branch, and those writes may also trigger **Gitea Actions** workflows on the private repository if Actions is enabled. Public reporting included a technical analysis and a working proof-of-concept, though no confirmed in-the-wild exploitation was cited. Administrators were urged to upgrade to **`v1.27.0`**, audit and rotate or revoke public-only tokens with write permissions, review public-to-private pull request relationships, and inspect recent private repository pushes and Actions logs for suspicious activity.
Jul 21, 2026
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
CISA added **CVE-2026-60004** to its Known Exploited Vulnerabilities catalog after confirming exploitation of a code-injection flaw in the Gitea self-hosted development platform. An attacker with repository write access can send a malicious patch to the `diffpatch` API, install an executable Git hook, and run shell commands under the Gitea service account. Gitea addressed the vulnerability in version **1.27.1**; CISA set an August 28 remediation deadline for U.S. federal agencies and advised affected organizations to apply vendor mitigations, assess internet exposure, and conduct relevant forensic triage. The responsible threat actors and their objectives remain unknown. CISA's preceding catalog update also added **CVE-2026-21962**, an improper access-control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. The Oracle flaw can permit unauthorized creation, deletion, modification, or access to critical data, potentially extending to all accessible product data. Organizations should prioritize patching or applying vendor mitigations for both KEV-listed vulnerabilities, and discontinue affected products where mitigations are unavailable.
Aug 28, 2026