Gitea RCE exploited, drops miner payload

What Happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning Tuesday regarding active exploitation of a critical remote code execution (RCE) vulnerability in Gitea, a popular self-hosted Git service. The flaw, CVE-2026-60004, was recently patched but attackers are already leveraging it in the wild. Reports indicate successful exploitation results in the deployment of a cryptocurrency miner-like payload on affected servers, suggesting opportunistic, financially motivated threat actors are actively scanning for vulnerable instances.

CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, a strong signal that federal agencies and critical infrastructure operators are now under a binding operational directive to remediate the issue. The warning elevates this from a routine patch notification to an urgent, government-acknowledged threat.

Why It Matters

Gitea is widely deployed by small and medium-sized businesses, academic institutions, and development teams that prefer a lightweight, self-hosted alternative to GitHub or GitLab. Because the software runs on-premises and often holds proprietary source code, CI/CD pipelines, and credentials, a successful RCE grants attackers a foothold at the heart of the software development lifecycle.

The active exploitation and payload choice are particularly concerning. Attackers dropping miner-like payloads indicates they prioritize immediate resource hijacking over stealthy data exfiltration. However, the initial access achieved through this RCE can easily be repurposed for lateral movement, supply chain attacks, or ransomware deployment. The window between patch availability and active exploitation appears extremely short, leaving understaffed teams with little time to react.

Technical Details

The vulnerability, CVE-2026-60004, is a critical RCE flaw that enables an unauthenticated or low-privileged attacker to execute arbitrary code on the underlying server. While the specific attack vector is not yet fully disclosed in public reporting, the active exploitation likely involves specially crafted HTTP requests that exploit a parsing or handling flaw in Gitea’s web interface.

Post-exploitation activity observed in the wild involves downloading and executing a payload that establishes a persistent foothold and initiates CPU-intensive mining operations. This behavior is consistent with common cryptojacking campaigns that target exposed, internet-facing services. Indicators of compromise (IOCs) would include unexpected outbound connections to mining pools, abnormal CPU spikes on Gitea servers, and the presence of suspicious processes or scheduled tasks.

Immediate Risk

The immediate risk is high. CISA’s KEV catalog inclusion confirms that exploitation is occurring, and the attack surface is substantial. Any Gitea instance exposed to the internet that has not been updated to the patched version is at direct risk. Given the relatively short time between disclosure and exploitation, threat actors are likely mass-scanning for vulnerable deployments.

Organizations running Gitea should treat this as an emergency. The impact extends beyond server resource theft; attackers holding RCE access can steal source code, inject malicious code into software builds, or use the server as a pivot point into the broader network.

Security Insight

The swift transition from patch release to active exploitation here mirrors the recent acceleration seen with vulnerabilities in other popular self-hosted tools. The era of “patch within 30 days” is over for internet-facing services. A more effective approach is to treat any self-hosted collaboration tool as part of the critical infrastructure attack surface and enforce a zero-trust architecture. This means placing Gitea behind a VPN or reverse proxy with strict access controls, rather than relying on the application’s own authentication alone.

For defensive teams, the miner payload is a useful indicator but not the end goal. Assume that a compromise initially disguised as cryptojacking may involve secondary, stealthier implants. Check for unusual admin accounts, review recent changes to repository webhooks (a common method for executing code on CI runners), and monitor for outbound SSH or HTTPS traffic that does not match known development workflows. A complete forensic review of any compromised host is essential, not just a cleanup of the mining process.

Further Reading

• Latest Security News
• CVE Advisories
• Data Breach Reports