Gitea unauthenticated RCE exploited in wild (CVE-2026-60004) [PoC]

Actively exploited in the wild - CVE-2026-60004 is a critical remote code execution vulnerability in Gitea before 1.27.1 that lets unauthenticated attackers execute arbitrary commands on the server through the diffpatch API. Patched in version 1.27.1 - update immediately.

Overview

CVE-2026-60004 is a critical remote code execution (RCE) flaw with a CVSS score of 9.8. The vulnerability exists in the diffpatch API endpoint of Gitea, a popular self-hosted Git service. An attacker can exploit the API to install malicious Git hooks, which execute automatically when repository events occur, giving them full control over the affected server.

The attack requires no authentication and no user interaction. An attacker with network access to the Gitea instance can send crafted requests to the diffpatch API, which improperly handles patch data and allows Git hook installation. Once installed, the hooks run with the privileges of the Gitea process, leading to complete server compromise.

Impact

Successful exploitation grants the attacker:

• Full remote code execution on the host system
• Access to all repositories, including private ones
• Credentials and secrets stored in the Gitea configuration
• Potential lateral movement into the broader network

The CISA Known Exploited Vulnerabilities (KEV) catalog confirms active exploitation in the wild, meaning real-world attacks are already occurring. Given the unauthenticated nature and low attack complexity, any internet-exposed Gitea instance is at immediate risk.

Remediation

Upgrade Gitea to version 1.27.1 or later as soon as possible. The fix addresses the hook installation vector in the diffpatch API. If you cannot upgrade immediately:

1. Restrict network access to the diffpatch API endpoint using firewall rules or a reverse proxy
2. Disable the API if it is not required for your workflow
3. Audit existing repositories for unauthorized hooks
4. Review server logs for suspicious diffpatch requests

After upgrading, verify that no unauthorized Git hooks exist in your repositories and rotate any credentials that may have been exposed.

Security Insight

This vulnerability follows a pattern of Git-related services exposing dangerous API endpoints that bypass normal authentication flows. The ability to install hooks through an API reflects a trust assumption that input validation alone cannot protect. Gitea’s rapid fix in 1.27.1 is commendable, but the exploit confirms that self-hosted development tools remain prime targets - they hold source code, credentials, and often sit on internal networks with elevated trust. Organizations should treat these platforms as critical infrastructure and apply the same patching urgency as they would for edge devices.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs