Critical Gitea Flaw Under Active Attack as Hackers Deploy Cryptomining Payload

A critical remote code execution vulnerability in Gitea is being actively exploited by unknown threat actors deploying cryptocurrency-mining malware on unpatched servers worldwide, prompting an urgent warning from U.S. cybersecurity authorities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on Tuesday warning of active exploitation targeting CVE-2026-60004, a flaw carrying a near-perfect CVSS score of 9.8. Federal agencies have been ordered to patch the vulnerability by August 28, 2026.

---

The Vulnerability and Why It Matters

Gitea is a widely used open-source self-hosted Git service popular among developers and DevOps teams. The flaw resides in its diffpatch API endpoint and allows an attacker with basic repository write access to execute arbitrary shell commands as the Gitea operating system user — essentially handing over complete control of the server.

What makes this vulnerability particularly alarming is how little access an attacker needs to trigger it. Because Gitea enables open registration by default, any anonymous visitor can create a free account, spin up a repository, and immediately gain the write permissions needed to launch a full remote code execution attack — no stolen credentials required.

"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account," CISA stated in its advisory.

Security researcher Shai Rod, known online as NightRang3r, has been credited with discovering and reporting the flaw. The vulnerability affects all Gitea versions from 1.17 onward and has been patched in version 1.27.1. Understanding why cybersecurity vigilance matters for modern infrastructure has never been more relevant — a single unpatched endpoint in a widely deployed developer tool can expose entire organizations to compromise within minutes.

How the Attack Is Structured

The exploit chain is straightforward and requires minimal technical sophistication on the attacker's part:

• An attacker registers a free account on any Gitea instance with open registration enabled
• They create a repository, granting themselves automatic write access
• A malicious patch is submitted to the diffpatch API endpoint
• An executable Git hook is planted, allowing arbitrary shell commands to run as the Gitea service account
• The server is compromised without any privileged credentials ever being stolen or guessed

This low barrier to entry is what elevates the risk from notable to critical. The attacker does not need to brute-force passwords, purchase stolen credentials, or conduct reconnaissance. Default settings do the work for them.

---

A Real-World Attack Exposes the Threat

The danger moved from theoretical to concrete when a full-stack developer named Andrey, posting under the handle @Causelof on the Russian blogging platform Habr, published a detailed account of how his own Gitea server was compromised using this exact vulnerability.

The attack first came to Andrey's attention through an email from his hosting provider HOSTKEY. The provider flagged that his virtual private server had sustained CPU usage above 70% for an extended period — a violation of service terms — forcing a temporary throttling of available processing resources. The culprit turned out to be a cryptomining-style dropper planted by an unknown threat actor exploiting CVE-2026-60004.

The Configuration Settings That Enabled the Attack

Andrey identified four specific configuration settings on his server that collectively enabled the attack:

• DISABLE_REGISTRATION = false — allowed anyone to register an account
• REGISTER_EMAIL_CONFIRM = false — no email verification required for new accounts
• ENABLE_OPENID_SIGNUP = true — permitted registration via OpenID
• REQUIRE_SIGNIN_VIEW = false — allowed unauthenticated users to browse the instance

"The fact that open registration is enabled here is significant precisely because of its connection to the vulnerability," Andrey noted. "A new user could register, create their own repository, and obtain the necessary write permissions within it."

What the Dropper Did Once Inside

Before deploying its payload, the dropper script executed a methodical series of preparatory steps. It cleared environment variables including LD_PRELOAD and LD_LIBRARY_PATH, scanned for high-CPU processes and attempted to kill competing activity — behavior consistent with cryptojacking and other aggressive malware types that eliminate rival miners to monopolize system resources — then fetched and executed an architecture-specific payload before deleting the file to cover its tracks.

This self-cleaning behavior is a hallmark of professionally maintained malware campaigns. The deliberate removal of the payload file after execution significantly hampers forensic investigation and is designed to leave defenders with an incomplete picture of what occurred.

---

What Remains Unknown and What Comes Next

Despite the detailed account Andrey provided, significant gaps remain in the public understanding of this campaign. Andrey acknowledged that he did not conduct a full analysis of the next-stage payload and stated plainly: "I do not have confirmed information regarding the mining pool, wallet, miner family, or specific operator."

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog but did not disclose whether its decision was based on Andrey's documented incident or on separate intelligence involving attacks against U.S. federal infrastructure. The identity of the threat actor or actors behind the campaign remains unknown.

The Broader Pattern of Cryptojacking Against Developer Infrastructure

The attack pattern — leveraging open registration to bypass authentication barriers, then deploying resource-draining payloads — mirrors the broader surge in cryptojacking campaigns targeting developer infrastructure. Default software configurations can become a system's most dangerous feature when left unchanged in a production environment. This is not an isolated case; developer tools, CI/CD pipelines, and self-hosted version control systems have become increasingly attractive targets precisely because they are trusted, resource-rich, and frequently under-monitored.

Campaigns of this nature also carry secondary risks beyond CPU theft. Once an attacker has achieved remote code execution on a server hosting source code, the potential exists for intellectual property theft, supply chain poisoning, or lateral movement into connected systems. The cryptomining payload observed here may represent only the most visible layer of a deeper intrusion. The threat posed by attacks that hold infrastructure hostage for financial gain shares characteristics with ransomware attacks and their impact on organizations — in both cases, the underlying access gained is often more dangerous than the immediate damage observed.

Immediate Steps Organizations Should Take

Organizations running Gitea should treat this as an urgent remediation priority. Upgrading to version 1.27.1 closes the vulnerability directly. Administrators who cannot patch immediately should disable open registration by setting DISABLE_REGISTRATION = true and enabling email confirmation to prevent anonymous account creation.

For teams managing self-hosted developer tools more broadly, this incident illustrates the risk hidden in default configurations that prioritize convenience over security. Periodic audits of registration settings, API exposure, and user permission structures can reveal dangerous attack surfaces before threat actors do. The CISA Known Exploited Vulnerabilities catalog is a reliable reference for tracking actively weaponized flaws and should be consulted regularly by any team responsible for infrastructure security.

Monitoring for unexpected spikes in CPU or network activity remains a reliable early warning signal for cryptojacking campaigns and should be incorporated into standard infrastructure health checks for any organization running open-source hosting platforms. Automated alerting thresholds, combined with regular reviews of active processes and outbound network connections, provide a practical first line of defense when patches cannot be applied immediately.