NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Gitea code execution flaw CVE-2026-60004 exploited to steal source code and credentials; fix available

Attackers have exploited Gitea's CVE-2026-60004 to run code on self-hosted development servers and steal repositories and credentials. Administrators should update to 1.27.1 or later and investigate earlier compromise.

What to do

If your family business or office runs Gitea, ask its administrator to update to 1.27.1 or later and disable open registration where it is unnecessary. Ask them to check for earlier compromise and rotate credentials stored on any compromised server. Ordinary household devices do not need a Gitea update.

What’s happening

Gitea, a self-hosted service for storing and managing software source code, has a critical flaw in its patch-processing API. Someone with repository write access can run commands with the Gitea service account's permissions; default open registration makes that access easier to obtain. Gitea identifies versions from 1.17 to before 1.27.1 as affected and released the fix on 27 July. CISA confirmed exploitation through its 25 August catalogue addition. In September, Acronis reported that Red Heron used the flaw in a multinational campaign involving source-code theft, credential collection and persistent access to connected systems. The software fix is available, but administrators must also investigate previous compromise. Whether that campaign remains active on 3 November is not known.

What
Flaw
Affects
Gitea self-hosted source-code server
Affected
Gitea >=1.17, <1.27.1
Fixed in
Gitea 1.27.1
CVE
CVE-2026-60004
Since
25 Aug 2026
Closed
13 Sept 2026

Timeline

  1. Wider attacks

    Acronis published its Red Heron investigation, confirming compromises in Canada, Argentina, Taiwan, the United States and Sri Lanka. It documented source-code theft, persistent access and movement into connected systems, and advised administrators to investigate earlier compromise alongside patching.

  2. Update

    Shadowserver found 8,393 IP addresses hosting vulnerable Gitea servers in its scans. It published the count the following day and warned that the flaw was being exploited.

  3. CISA added

    CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.

  4. Wider attacks

    According to Acronis's later investigation, Red Heron had scanned 1,386 Gitea servers across seven countries by this date. Its activity subsequently included stealing repositories and credentials and maintaining access to compromised systems.

  5. Made public

    Gitea published its critical-severity advisory, identifying versions from 1.17 up to, but excluding, 1.27.1 as affected. Repository write access lets an attacker run commands with the Gitea service account's permissions.

  6. New fixFixed

    Gitea released 1.27.1 with a fix for CVE-2026-60004 and urged users to upgrade.

Sources

  1. Remote Code Execution via diffpatch Git Hook InstallationGitea · 28 July 2026
  2. Gitea 1.27.1 is releasedGitea · 27 July 2026
  3. Gitea security advisory (AV26-845) - Update 1Canadian Centre for Cyber Security · 20 Oct 2026
  4. Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkitAcronis · 13 Sept 2026
  5. Shadowserver reports 8,393 IP addresses vulnerable to CVE-2026-60004The Shadowserver Foundation · 28 Aug 2026
  6. Hackers now exploit critical Gitea flaw in code injection attacksBleepingComputer · 26 Aug 2026
  7. Over 8,300 Gitea servers vulnerable to code execution attacksBleepingComputer · 28 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS