# Critical Gitea Flaw Lets Attackers Hijack Servers in Seconds — CISA Orders Federal Patch

*2026-08-27 06:01 UTC · Technology · 1 min read*

> A critical, actively exploited Gitea flaw (CVSS 9.8) lets attackers with repository write access run arbitrary shell commands, and CISA has ordered federal agencies to patch by August 28.

A critical code injection vulnerability in the Gitea Git hosting platform, tracked as CVE-2026-60004 and rated 9.8 out of 10 on the CVSS scale, is now being actively exploited in the wild. The flaw lets anyone with ordinary repository write access abuse Gitea's diffpatch endpoint to plant an executable Git hook and run arbitrary shell commands with the privileges of the Gitea service account.

On instances that allow open user registration, that bar is trivial to clear: an attacker can simply sign up for a normal account, create a repository, and trigger the exploit chain. One documented attack against a self-hosted, outdated Gitea instance completed in roughly 11 seconds and deployed crypto-mining software, according to an incident report that first surfaced on the Russian blogging platform Habr.

CISA confirmed active exploitation on August 25, 2026, adding CVE-2026-60004 to its Known Exploited Vulnerabilities catalog and ordering federal civilian agencies to remediate by August 28. The bug was patched by Gitea's developers in version 1.27.1, with 1.27.2 as the latest fixed release — administrators running older versions are urged to update immediately and disable open registration where possible.

## Sources

- [helpnetsecurity.com](https://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/)
- [thehackernews.com](https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html)
- [securityweek.com](https://www.securityweek.com/cisa-warns-of-exploited-gitea-vulnerability/)

---
TechTools News · https://techtools.cz/tools/news/article/2262-critical-gitea-flaw-lets-attackers-hijack-servers-in-seconds-cisa-orders
Česká verze: https://techtools.cz/tools/news/clanek/2335-kriticka-chyba-v-gitea-umoznuje-ovladnout-server-behem-sekund-cisa-naridila