{"id":"gitea-code-injection-attacks-jul-2026","category":"patch","status":"closed","title":"Gitea code execution flaw CVE-2026-60004 exploited to steal source code and credentials; fix available","tldr":"Attackers have exploited Gitea's CVE-2026-60004 to run code on self-hosted development servers and steal repositories and credentials. Administrators should update to 1.27.1 or later and investigate earlier compromise.","summary":"Gitea, a self-hosted service for storing and managing software source code, has a critical flaw in its patch-processing API. Someone with repository write access can run commands with the Gitea service account's permissions; default open registration makes that access easier to obtain. Gitea identifies versions from 1.17 to before 1.27.1 as affected and released the fix on 27 July. CISA confirmed exploitation through its 25 August catalogue addition. In September, Acronis reported that Red Heron used the flaw in a multinational campaign involving source-code theft, credential collection and persistent access to connected systems. The software fix is available, but administrators must also investigate previous compromise. Whether that campaign remains active on 3 November is not known.","action":"If your family business or office runs Gitea, ask its administrator to update to 1.27.1 or later and disable open registration where it is unnecessary. Ask them to check for earlier compromise and rotate credentials stored on any compromised server. Ordinary household devices do not need a Gitea update.","product":"Gitea self-hosted source-code server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-60004"],"tags":["gitea","code-execution","actively-exploited","source-code-theft","server"],"affected":["Gitea >=1.17, <1.27.1"],"fixed":["Gitea 1.27.1"],"matches":[],"sources":[{"kind":"advisory","title":"Remote Code Execution via diffpatch Git Hook Installation","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","by":"Gitea","date":"2026-07-28"},{"kind":"post","title":"Gitea 1.27.1 is released","url":"https://blog.gitea.com/release-of-1.27.1/","by":"Gitea","date":"2026-07-27"},{"kind":"advisory","title":"Gitea security advisory (AV26-845) - Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/gitea-security-advisory-av26-845","by":"Canadian Centre for Cyber Security","date":"2026-10-20"},{"kind":"research","title":"Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit","url":"https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/","by":"Acronis","date":"2026-09-13"},{"kind":"post","title":"Shadowserver reports 8,393 IP addresses vulnerable to CVE-2026-60004","url":"https://bsky.app/profile/shadowserver.bsky.social/post/3mu5chx5eos2l","by":"The Shadowserver Foundation","date":"2026-08-28"},{"kind":"news","title":"Hackers now exploit critical Gitea flaw in code injection attacks","url":"https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks/","by":"BleepingComputer","date":"2026-08-26"},{"kind":"news","title":"Over 8,300 Gitea servers vulnerable to code execution attacks","url":"https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/","by":"BleepingComputer","date":"2026-08-28"}],"started":"2026-08-25","closed":"2026-09-13","created":"2026-11-03T22:13:59.684Z","updated":"2026-11-03T22:13:59.684Z","cve_notes":[{"cve":"CVE-2026-60004","name":"Code execution in Gitea's diffpatch API","what":"Gitea's diffpatch API can turn repository content into an executable Git hook, allowing an attacker with repository write access to run commands as the Gitea service account.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-13","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Acronis published its Red Heron investigation, confirming compromises in Canada, Argentina, Taiwan, the United States and Sri Lanka. It documented source-code theft, persistent access and movement into connected systems, and advised administrators to investigate earlier compromise alongside patching.","url":"https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/","by":"Acronis","patch":null},{"at":"2026-08-27","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Shadowserver found 8,393 IP addresses hosting vulnerable Gitea servers in its scans. It published the count the following day and warned that the flaw was being exploited.","url":"https://bsky.app/profile/shadowserver.bsky.social/post/3mu5chx5eos2l","by":"The Shadowserver Foundation","patch":null},{"at":"2026-08-25","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/gitea-security-advisory-av26-845","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-07-30","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"According to Acronis's later investigation, Red Heron had scanned 1,386 Gitea servers across seven countries by this date. Its activity subsequently included stealing repositories and credentials and maintaining access to compromised systems.","url":"https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/","by":"Acronis","patch":null},{"at":"2026-07-28","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Gitea published its critical-severity advisory, identifying versions from 1.17 up to, but excluding, 1.27.1 as affected. Repository write access lets an attacker run commands with the Gitea service account's permissions.","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","by":"Gitea","patch":null},{"at":"2026-07-27","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Gitea released 1.27.1 with a fix for CVE-2026-60004 and urged users to upgrade.","url":"https://blog.gitea.com/release-of-1.27.1/","by":"Gitea","patch":"patched"}],"url":"https://hard.fyi/live/gitea-code-injection-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=gitea-code-injection-attacks-jul-2026"}