Skip to content

Gitea diffpatch Git-hook RCE added to CISA KEV (CVE-2026-60004)

Summary

On August 25, 2026, CISA added Gitea CVE-2026-60004 (GHSA-rcr6-4jqh-j84m, CVSS 9.8 Critical, code injection, CWE-94) to the Known Exploited Vulnerabilities catalog, with a 2026-08-28 BOD 26-04 federal remediation deadline. The flaw lets an attacker with ordinary write access to a Gitea repository abuse the diffpatch endpoint to install and execute a Git hook from repository-controlled content — running arbitrary shell commands as the Gitea service account. With default open registration, an unauthenticated visitor can first obtain the required write access by registering an account and creating a repository, so a fresh, anonymous attacker can reach the same code-execution primitive on many default deployments.

The vulnerability was already fixed in Gitea 1.27.1 (released July 27, 2026 — the release's SECURITY section lists "Fix: git patch apply (#38637) (#38638)"), so this KEV entry confirms in-the-wild exploitation of a fix that was available ~29 days earlier. The practical signal: self-hosted Gitea instances below 1.27.1 that expose the diffpatch API are being actively targeted. CISA records ransomware use as unknown and identifies no actor, victim, or infrastructure.

On August 26, 2026, The Hacker News published the first public victim-side writeup of this exploitation wave: a Russian full-stack developer (Andrey, aka @Causelof, analysis on Habr) reported that a HOSTKEY VPS running Gitea with open registration enabled was compromised through HTTPS (SSH was not exposed) and used to deploy a cryptocurrency-miner-like dropper. The dropper behavior as described: clear LD_PRELOAD / LD_LIBRARY_PATH, search for and attempt to kill high-CPU competing processes, fetch an architecture-specific payload over HTTPS, write it to disk, execute it, and delete the file. The next-stage payload's exact nature (mining pool, wallet, family, operator) is unconfirmed. The hosting provider's >70%-CPU alert is what surfaced the intrusion.

Tags

The KEV entry

CISA's entry (added 2026-08-25, BOD 26-04 due 2026-08-28) points to the Gitea advisory GHSA-rcr6-4jqh-j84m and adds no exploitation detail:

  • CWE: CWE-94 (code injection)
  • CVSS 3.1: 9.8 Critical — network attack vector, no user interaction required for the write-access holder; low privileges (repository write access)
  • Affected versions: Gitea >= 1.17, < 1.27.1 (Go / gomod, gitea.dev); patched in 1.27.1 (July 27, 2026; also carried in 1.27.2, August 13, 2026)
  • Required action: apply mitigations per vendor instructions (upgrade to 1.27.1 or later), follow BOD 26-04 for cloud services or discontinue use if mitigations are unavailable
  • Ransomware use: unknown; no actors, infrastructure, payloads, or victims identified

How it works

Gitea's services/repository/files/patch.go applies an attacker-controlled patch to a shared bare temporary clone via git apply --index --recount --cached --binary, adding -3 when Git is 2.32 or newer. Submitting the same patch twice produces an add/add collision; Git's three-way fallback then checks the indexed path out even though the operation ran with --cached. In a bare clone the repository root is $GIT_DIR, so an executable entry named hooks/post-index-change becomes a live Git hook. Git invokes that hook while writing the index, so repository-controlled content executes arbitrary commands as the Gitea service account. The hook's return value is not propagated to the diffpatch response, keeping the operation quiet.

The advisory's PoC (gitea_diffpatch_rce_poc.py) stores command output in Git objects and creates a branch containing the result, so no outbound connection is required — the result is fetched back through authenticated smart HTTP. Reported evidence shape: uid=1000(git) gid=1000(git) ... /data/gitea/tmp/... [exit-status=0]. The trigger requires Git 2.32 or newer, an enabled diffpatch route, and a writable/executable temporary filesystem. Open registration is required only for the no-prior-credentials path (register → create repo → obtain write access).

Context

  • Disclosure vs. exploitation timing: Gitea fixed this in 1.27.1 on July 27, 2026; CISA added it to KEV on August 25, 2026 — a ~4-week window in which in-the-wild exploitation was occurring against unpatched instances.
  • Gitea exposure: Gitea is one of the most-deployed self-hosted Git servers (cloud.gitea.com auto-upgrades managed instances; the 1.26.x/1.27.x release notes repeatedly call out security fixes). Self-hosted operators on 1.17–1.27.0 are the primary blast radius.
  • Prior Gitea KEV/active-exploitation context in this wiki: the July 2026 Gitea Docker CVE-2026-20896 reverse-proxy trusted-proxy wildcard probing entry (separate product surface: Gitea's Docker image reverse proxy, not the core diffpatch API). This entry is a distinct, core-application code-injection flaw.
  • First public victim report (August 26, 2026, THN / Habr): a HOSTKEY VPS running Gitea was targeted via HTTPS with open registration enabled (DISABLE_REGISTRATION = false, REGISTER_EMAIL_CONFIRM = false, ENABLE_OPENID_SIGNUP = true, REQUIRE_SIGNIN_VIEW = false); the attacker registered, created a repository, obtained write access, and dropped a miner-like dropper that killed competing high-CPU processes, fetched an architecture-specific payload, ran it, and deleted the file. SSH was not exposed. The victim had not analyzed the next stage; mining-pool / wallet / family / operator are unconfirmed.
  • No actor attribution: no public report ties exploitation to a named actor or campaign; treat as unattributed in-the-wild exploitation (cryptojacking-shaped dropper) until a named-actor assessment or takedown links the operations.

Defender priorities

  1. Upgrade every Gitea instance to 1.27.1 or later (1.27.2 is current as of August 13, 2026). Verify with gitea --version on each node; self-hosted fleets frequently lag the upstream release.
  2. Confirm the diffpatch route is reachable and who has repository write access. If you cannot immediately patch, disable the diffpatch API surface (pull-request / compare patch endpoint) or restrict repository creation so anonymous registration cannot grant write access.
  3. Hunt for hooks/post-index-change in bare clones — an unexpected executable file under <repo>/.git/hooks/post-index-change (or $GIT_DIR/hooks/post-index-change for bare repos) is a strong post-exploitation indicator. Also hunt for new branches whose commits contain command output, and for git apply invocations from the Gitea service account that target a shared temp clone.
  4. Scope the Gitea OS user. RCE lands as the Gitea service account; if that account has broad filesystem or credential access (e.g., a shared git user on a host that also runs other services), treat compromise as host-level and rotate any credentials reachable from that account.
  5. Review open registration and repo-creation policy. Instances with open registration let an unauthenticated visitor reach the write-access precondition; tighten sign-up or require authentication for repo creation where your workflow allows.
  6. Log and monitor for the distinctive sequence: two identical patch submissions to the same repo path (add/add collision) followed by a new branch containing shell output — this is the fingerprint of the advisory PoC and a likely exploitation marker.

Indicators

  • File: hooks/post-index-change (executable) inside a Gitea bare/temp clone ($GIT_DIR/hooks/post-index-change).
  • Behavior: repeated identical patch submissions to the diffpatch API (add/add collision); new branches created that contain command output rather than source changes.
  • Process: git apply --index --recount --cached --binary -3 run by the Gitea service account against a shared bare temp clone, with the hook invoked during index write.
  • Version boundary: Gitea >= 1.17, < 1.27.1 is affected; 1.27.1 (2026-07-27) and 1.27.2 (2026-08-13) contain the fix.

References

  • CISA KEV catalog entry (added 2026-08-25, BOD 26-04 due 2026-08-28): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • Gitea advisory GHSA-rcr6-4jqh-j84m (published 2026-07-28, critical, 9.8): https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-60004
  • Gitea v1.27.1 release (fix "Fix: git patch apply (#38637) (#38638)"): https://github.com/go-gitea/gitea/releases/tag/v1.27.1
  • BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
  • The Hacker News: Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload (August 26, 2026; first public victim report, Habr / @Causelof)