According to CISA's Known Exploited Vulnerabilities catalog entry, CVE-2026-60004 was added to the catalog on 2026-08-25, confirming active exploitation of a Gitea code injection bug that lets a user with repository write access execute shell commands as the Gitea service account.
What Is It
CVE-2026-60004 is a code injection vulnerability (CWE-94) in Gitea, the self-hosted Git service. An attacker who already holds write access to a repository can send a malicious patch to the diffpatch API endpoint. The crafted patch plants an executable Git hook, which then runs arbitrary shell commands under the identity of the Gitea service account.
The vulnerability is tracked in the vendor's GitHub Security Advisory GHSA-rcr6-4jqh-j84m.
Why It Matters
CISA's inclusion of this CVE in the KEV catalog indicates it is being actively exploited in the wild. That moves it out of theoretical-risk territory and into immediate-remediation territory. CISA does not publish exploitation details, victim counts, or attribution alongside KEV entries, so the catalog listing itself is the extent of the public evidence.
The impact profile is severe for anyone running Gitea as shared developer infrastructure. Repository write access is a low bar in most organizations; contributors, CI bots, and service integrations routinely hold it. Converting that routine permission into shell execution on the host means an attacker can pivot from "can push code" to "controls the Git server," with access to every repository, credential, and secret the Gitea service account can reach.
The KEV entry lists known ransomware campaign use as Unknown. That field reflects only what CISA has confirmed and recorded; it is not a statement that ransomware operators are absent, and it should not be read as a reason to deprioritize.
What's Vulnerable
- Vendor/Project: Gitea
- Product: Gitea
- Attack vector: The
diffpatchAPI endpoint - Prerequisite: Repository write access
- Weakness: CWE-94 (Improper Control of Generation of Code)
No CVSS score, severity rating, vector string, or affected version list (CPE data) is present in the supplied NVD record; the NVD entry is empty at time of writing. Consult the vendor advisory for exact affected version ranges.
Patch Status
Per the KEV entry, CISA's required action is to apply mitigations in accordance with vendor instructions, in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance. If mitigations are unavailable, discontinue use of the product.
Due date: 2026-08-28: three days after the KEV listing, per the catalog entry. That compressed window is short even by KEV standards; federal civilian agencies should treat it as a same-week action. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Gitea Security Advisory (GHSA-rcr6-4jqh-j84m), https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
- NVD, CVE-2026-60004, https://nvd.nist.gov/vuln/detail/CVE-2026-60004
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements; https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk