Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

CVE-2026-60004: Gitea Code Injection Vulnerability Actively Exploited

Posted on September 6, 2026 by Kyle

Overview

CVE-2026-60004 is a critical code injection vulnerability in Gitea versions prior to 1.27.1, actively exploited in the wild. It allows an attacker with repository write access to achieve remote code execution by leveraging the diffpatch API to install malicious Git hooks. This enables the execution of arbitrary shell commands under the Gitea service account, posing a significant risk to affected organizations.

Technical Analysis

  • Vulnerability: Gitea contains a code injection vulnerability (CWE-94) in its diffpatch API endpoint.
  • Affected Versions: Gitea versions gitea >= 1.17.0 < 1.27.1 are vulnerable.
  • Attack Vector: Exploitation requires an attacker with repository write access. Despite the NVD CVSS vector indicating PR:N (No Privileges), successful exploitation of this specific vulnerability path necessitates an authenticated user with sufficient permissions to modify repository content.
  • Exploitation: The attacker sends a malicious patch to the diffpatch API endpoint. This patch is crafted to plant an executable Git hook within the repository’s .git/hooks/ directory.
  • Impact: The malicious Git hook allows the attacker to run arbitrary shell commands as the Gitea service account, leading to remote code execution (RCE).
  • CVSS: CVSS 3.1 Base Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor Gitea server logs for unusual diffpatch API requests, especially those containing suspicious content or attempting to modify Git hooks.
  • Look for unexpected process spawns originating from the Gitea application process or the Gitea service account (e.g., git, sh, bash, powershell, cmd.exe).
  • Monitor for new or modified executable files within Git repository .git/hooks/ directories that are not part of legitimate operations.
  • Hunt for outbound network connections from the Gitea server to unusual or untrusted destinations.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Gitea RCE – Suspicious Child Process From Gitea

title: Gitea RCE - Suspicious Child Process From Gitea
id: 95d7e8a3-2c1b-4f8e-a9d0-1e2f3g4h5i6j
status: experimental
description: Detects suspicious child processes spawned by the Gitea application, indicative of successful CVE-2026-60004 exploitation leading to remote code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\gitea.exe'
      - '\gitea-windows-amd64.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection
level: critical

Mitigations

  1. Patch Immediately: Upgrade Gitea to version 1.27.1 or later. This is the primary and most effective mitigation.
  2. Restrict Access: Ensure that only trusted users have repository write access, as this is a prerequisite for exploitation.
  3. Network Segmentation: Isolate Gitea instances on the network to limit potential lateral movement in case of compromise.
  4. Least Privilege: Run the Gitea service with the minimum necessary privileges to reduce the impact of successful exploitation.

References

  • https://github.com/0xBlackash/CVE-2026-60004
  • https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
  • https://blog.gitea.com/release-of-1.27.1/
  • https://www.runzero.com/blog/gitea/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004
  • https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html

Indicators of Compromise

Type Value Description
SHA256 0b8e037d160bdb0b621c975c424f680b814bc438fd492ae376ff3140e209e480 XMRIG · confidence 100% · first seen 2026-08-27
SHA256 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab XMRIG · confidence 100% · first seen 2026-08-27
SHA256 a5d9970129afd6e1874cbeafa08df65a3d3599862357ae48bdad211e0f47264a XMRIG · confidence 100% · first seen 2026-08-27
IP Address 167.179.119.120 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 176.65.148.184 Attacker IP address observed in exploitation attempts against Switchvox instances (via https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html)
IP Address 176.65.148.250 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 193.41.68.194 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 2.26.99.68 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 216.98.10.60 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 34.70.205.211 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 92.246.139.83 XMRIG · confidence 100% · first seen 2026-08-27
IP Address 95.85.237.149 XMRIG · confidence 100% · first seen 2026-08-08
Domain 0x1x2x3.top XMRIG · confidence 100% · first seen 2026-08-27
Domain abcdefghijklmnopqrst.net XMRIG · confidence 100% · first seen 2026-08-27
Domain fix.unknower.win XMRIG · confidence 100% · first seen 2026-08-08
Domain kworker.eth.limo XMRIG · confidence 100% · first seen 2026-08-08
Domain kworker.eth.link XMRIG · confidence 100% · first seen 2026-08-08
URL http://0x1x2x3.top/ XMRIG · confidence 100% · first seen 2026-08-27
URL http://176.65.148.250:6556/ok XMRIG · confidence 100% · first seen 2026-08-08
URL http://92.246.139.83/1 XMRIG · confidence 100% · first seen 2026-08-27
URL http://92.246.139.83/2 XMRIG · confidence 100% · first seen 2026-08-27
URL http://92.246.139.83/3 XMRIG · confidence 100% · first seen 2026-08-27
URL http://cta.edu.pe/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-26
URL http://fix.unknower.win/ XMRIG · confidence 100% · first seen 2026-08-08
URL http://puschl.langhaar-schaeferhunde.com/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://casasmediterraneas.com/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://cloud.calltop.com.br/apps/web/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://cta.edu.pe/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://kworker.eth.limo/kworker/api XMRIG · confidence 100% · first seen 2026-08-08
URL https://kworker.eth.link/kworker/api XMRIG · confidence 100% · first seen 2026-08-08
URL https://www.mediocasavolponi.com/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
  • T1195 — Supply Chain Compromise
  • T1195.002 — Compromise Software Supply Chain
  • T1059 — Command and Scripting Interpreter
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,477 input / 1,433 output tokens ·
Reviewed and approved by a human analyst before publication

Post navigation

CVE-2026-48710: Starlette HTTP Request/Response Smuggling Vulnerability

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Proudly powered by WordPress | Theme: micro, developed by DevriX.