If you run a self-hosted Git service like Gitea, a critical vulnerability might already be used by attackers. CVE-2026-60004 is a pre-auth remote code execution flaw in the diffpatch path that could let an attacker run commands on your Gitea server. Patches were released, and CISA added it to KEV, signaling active exploitation and urging remediation.
What happened
The issue lives in Gitea’s diffpatch endpoint and can allow an attacker with access to the repository to execute commands on the server running Gitea. Gitea released a patched version (1.27.1) in late July 2026, and subsequent updates (1.27.2) were released in mid-August 2026 to address ongoing hardening. The vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, which indicates that active exploitation has been observed and federal agencies have remediation timelines. For context, you can review the official security advisory on Gitea’s GitHub security page and monitor the KEV entry for current status and guidance.
Transparency around these advisories matters because it helps smaller teams and individuals gauge risk and respond quickly. If you want to read the official advisories, you can visit the Gitea security advisories and the CISA KEV catalog.
Why it matters
- Impact on code and data: A remote code execution flaw in a code hosting platform like Gitea can give attackers control over the server, potentially leading to data exposure or modification.
- Small teams are at risk: Many teams self-host Git services to avoid third-party hosting fees. Delays in patching can leave code, secrets, and build pipelines exposed.
- Operational disruption: Exploitation can disrupt development workflows, slow release cycles, and require incident response work that distracts from normal business objectives.
Practical steps you can take
- Check your Gitea version: If you’re running a version prior to 1.27.1, upgrade immediately. If you’re on 1.27.1 or older, move to 1.27.2 or the latest 1.27.x release. The 1.27.2 release note contains important hardening and fixes.
- Apply the patch and restart services: After upgrading, fully restart Gitea and any connected services to ensure the fixes take effect.
- Harden access controls: If you cannot patch right away, disable open registration, limit repository write access, and review who has admin or repo-write rights. Rotate service account credentials if available.
- Review and rotate secrets: Revoke or rotate any tokens, SSH keys, and credentials used by automation that interacts with Gitea.
- Monitor logs and artifacts: Look for unusual diffpatch activity, unexpected file writes, or newly created hooks. Set up alerting for suspicious Git hooks or diffpatch requests.
- Run a quick scan: If you have a vulnerability scanner or SCA in place, run a scan focused on your Gitea server and Git infrastructure to look for indicators of compromise or misconfigurations.
- Plan a quick recovery: Ensure you have recent backups, tested restoration steps, and a rollback plan should anything go wrong during patching.
Final thought
Patch now, audit access, and tighten defenses around your Git infrastructure. Keeping self-hosted tools up to date is one of the most practical steps you can take to reduce risk without large budgets. If you’re unsure where to start, you can use this post as a checklist and reach out for targeted guidance as you update your setup.
Learn more about the advisory status and keep an eye on official sources for the latest updates: Gitea security advisories and CISA KEV catalog.