Ethical Hacking News
A critical security flaw in Gitea version control system has been exposed, exposing unpatched servers to remote code execution vulnerabilities. The vulnerability, identified as CVE-2026-60004, holds a significant CVSS score of 9.8 and can be exploited by an attacker with ordinary write access to a repository. System administrators and developers are urged to patch the flaw by August 28, 2026, while prioritizing updates based on a risk-based approach.
There is a critical security flaw in the Gitea version control system (CVE-2026-60004) with a CVSS score of 9.8. The vulnerability allows an attacker with ordinary write access to execute arbitrary shell commands as the Gitea OS user. The vulnerability was reported by security researcher Shai rod and corroborated by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability arises from code injection, which allows an attacker to plant an executable Git hook. Open registration in Gitea makes it possible for an external actor to create an account and trigger the exploit. A recent incident highlighted the importance of the DISABLE_REGISTRATION parameter in preventing exploitation. CISA has urged U.S. federal agencies to patch the flaw by August 28, 2026, and prioritized updates based on a risk-based approach.
The cybersecurity landscape has recently been shaken by the revelation of a critical security flaw in the Gitea version control system. The vulnerability, identified as CVE-2026-60004, holds a significant CVSS score of 9.8, making it a severe remote code execution vulnerability. This means that an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user, potentially leading to catastrophic consequences.
The vulnerability was first reported by security researcher Shai rod, alias NightRang3r, who discovered and reported the issue. Shai's findings have since been corroborated by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. This move is a stark reminder of the importance of patching critical vulnerabilities in a timely manner.
The vulnerability in question arises from a case of code injection, which allows an attacker to send a malicious patch to the diffpatch API endpoint. This malicious patch can then be used to plant an executable Git hook, allowing the attacker to run shell commands as the Gitea service account. The key factor contributing to the vulnerability's severity is the presence of open registration, which makes it possible for an external actor to create an account and a repository, thus triggering the exploit without relying on pre-existing credentials.
Furthermore, an analysis published by full-stack developer Andrey, alias @Causelof, has revealed that the Gitea instance they were using was targeted by an unknown threat actor using CVE-2026-60004 to deploy a cryptocurrency-miner-like dropper. The incident came to light after receiving an email notification from hosting provider HOSTKEY, stating their virtual server had been using more than 70% of the processor capacity for an extended period of time in violation of the service's terms.
Andrey's analysis highlighted the importance of the DISABLE_REGISTRATION parameter, which is set to false in this instance. The parameter is crucial because it determines whether only an admin can create accounts for users. The presence of this parameter in the configuration made it possible for the attacker to create a new user and obtain the necessary write permissions within the repository.
The attack vector employed by the attacker was via HTTPS, and the dropper script undertook several steps before deploying the miner-like payload, including clearing LD_PRELOAD and LD_LIBRARY_PATH, searching for processes with high CPU usage, attempting to kill competing processes, fetching the payload based on the system architecture, downloading, writing it to a location on disk, and running it. The exact nature of the next-stage payload is unknown, as the developer did not conduct an analysis of its contents.
The revelation of this critical vulnerability has sparked a wave of urgency among system administrators and developers. CISA has urged U.S. federal agencies to patch the flaw by August 28, 2026, while prioritizing updates based on a risk-based approach. This move is a stark reminder of the importance of proactive vulnerability management and the need for timely patching of critical security flaws.
In conclusion, the critical Gitea vulnerability exposed in this report underscores the gravity of remote code execution vulnerabilities. The vulnerability's CVSS score of 9.8 signifies its severity, making it a critical concern for system administrators and developers. The attack vector employed by the attacker highlights the importance of configuring parameters, such as DISABLE_REGISTRATION, to prevent exploitation. As a result, it is imperative to patch this vulnerability as soon as possible to prevent potential attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Gitea-Flaw-Exposed-Unpatched-Servers-Under-Threat-from-Remote-Code-Execution-Vulnerability-ehn.shtml
https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html
https://utopiats.com/blog/critical-gitea-rce-actively-exploited-as-reported-attack-drops-miner-like-payload
Published: Wed Aug 26 03:18:20 2026 by llama3.2 3B Q4_K_M
