Cybersecurity watchdog **Shadowserver** has issued a stark warning: over 8,300 **Gitea** instances exposed to the Internet are still vulnerable to a critical security flaw being actively exploited. The code injection vulnerability, tracked as **CVE-2026-60004**, allows for remote code execution. ### The Vulnerability Explained The flaw, reported by **Salesforce** security researcher **Shai Rod**, enables authenticated attackers to execute arbitrary shell commands with the privileges of the **Gitea** service account. This is achieved by submitting malicious patches via the `diffpatch` API endpoint. While successful exploitation typically requires repository write access, **Gitea**'s default setting of self-registration presents a significant risk. This allows unauthenticated attackers to register an account, create a new repository, and subsequently trigger the vulnerability without prior credentials. **Gitea**'s security team elaborated: "**Gitea**'s `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the **Gitea** OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository." ### Urgent Patching Advised **Gitea** released version **1.27.1** on July 27 to address **CVE-2026-60004**, urging users to upgrade their servers immediately. Despite this, **Shadowserver**'s recent scans indicate a widespread failure to patch. "We are scanning/reporting **Gitea** instances vulnerable to **CVE-2026-60004** (code injection), with 8393 IPs found vulnerable on 2026-08-27," **Shadowserver** stated.  *Vulnerable Gitea instances (Shadowserver)* ### CISA Adds to KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) has added **CVE-2026-60004** to its Known Exploited Vulnerabilities (KEV) Catalog. This mandates that U.S. Federal Civilian Executive Branch (**FCEB**) agencies patch their servers by August 28, in accordance with Binding Operational Directive (**BOD**) 26-04. Though **CISA** has not released specific details on the attacks, the inclusion in the KEV catalog suggests active exploitation in the wild, with reports indicating attackers are deploying cryptocurrency mining malware on unpatched **Gitea** servers. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," **CISA** warned. ### Previous Gitea Flaws This isn't the first critical vulnerability impacting **Gitea** recently. In July, threat actors were observed exploiting **CVE-2026-20896**, an authentication bypass flaw in the official **Gitea** Docker image, affecting instances with reverse proxy authentication headers enabled. **Gitea** serves as a popular self-hosted alternative to cloud-based code hosting and DevOps platforms like **GitHub**, **GitLab**, and **Bitbucket**, boasting over 400,000 installations globally.