Critical Gitea RCE Vulnerability CVE-2026-60004 Actively Exploited
- Severity
- HIGH
- Affected component
- gitea (github-actions)
- Affected versions
- >= v1.27.0, <= v1.27.0 or >= v1.27.0-rc0, <= v1.27.0-rc0 or >= v1.28.0-dev, <= v1.28.0-dev or >= v1.27.0-dev, <= v1.27.0-dev or >= v1.26.0-dev, <= v1.26.0-dev or >= v1.25.0-dev, <= v1.25.0-dev or >= v1.24.0-dev, <= v1.24.0-dev or >= v1.22.0-rc1, <= v1.22.0-rc1 or >= v1.23.0-dev, <= v1.23.0-dev or >= v1.22.0-rc0, <= v1.22.0-rc0 or >= v1.21.0-rc0, <= v1.21.0-rc0 or >= v1.22.0-dev, <= v1.22.0-dev or >= v1.20.0-rc0, <= v1.20.0-rc0 or >= v1.21.0-dev, <= v1.21.0-dev or >= v1.20.0-dev, <= v1.20.0-dev or >= v1.19.0-rc0, <= v1.19.0-rc0 or >= v1.18.0-rc0, <= v1.18.0-rc0 or >= v1.19.0-dev, <= v1.19.0-dev or >= v1.18.0-dev, <= v1.18.0-dev or >= v1.17.0-dev, <= v1.17.0-dev
- Patched version
- 1.27.1
A critical remote code execution vulnerability in Gitea, tracked as CVE-2026-60004, is being actively exploited. Users of affected versions should upgrade immediately.
What happened
CVE-2026-60004 is a remote code execution vulnerability in Gitea that allows an attacker with write access to a repository to execute arbitrary shell commands as the Gitea OS user. This vulnerability affects all versions of Gitea from 1.17 to 1.27.0 and has been patched in version 1.27.1. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation efforts targeting this flaw. Over 8,300 Gitea servers remain vulnerable to code execution attacks.
The vulnerability can be exploited through Gitea's diffpatch endpoint, which can be abused to install and execute a Git hook from repository-controlled content. Default-configured Gitea instances have self-registration enabled, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials.
What to do about it
- Upgrade to Gitea version 1.27.1 or later to mitigate the risk of remote code execution.
- Disable self-registration on Gitea instances to prevent unauthenticated attackers from creating accounts and triggering the vulnerability.
- Monitor your Gitea instances for any suspicious activity or unauthorized access.
- Review your Gitea configurations and ensure that only trusted users have write access to repositories.
How 0Day would have caught this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Gitea version 1.17 or later up to 1.27.0, you are affected. Upgrade to version 1.27.1 or later.
What should I do right now?
Upgrade to Gitea version 1.27.1 or later immediately to mitigate the risk of remote code execution.
Has this been exploited in the wild?
Yes, CVE-2026-60004 is being actively exploited.