CVE-2026-600049.8CriticalCWE-94
Gitea Code Injection Vulnerability
Exploited in the wild · in CISA KEV since 25 AugFixed in version 1.27.1Exploitation attributed to Red Heron (per Acronis Threat Research Unit, SecurityOnline)
24.0%probability of exploitation in the next 30 days
97th percentile
050100
Higher than 97% of scored CVEs
9.8CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 25 Aug · catalogue entry
Passed 60 days ago
DescriptionNVD
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage7 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 29 Jul.
Quiet for 6 weekslast report 15 Sep7 articles4 outlets
- Wed 29 Jul, 10:11 UTC. SecurityOnline, first report. CVE-2026-60004: Gitea RCE lets attackers run code via Git hook. Cites a CVE in CISA KEV.
- Tue 25 Aug, 22:43 UTC. CISA, its first report on the story. CISA Flags Gitea Code Injection Flaw in KEV Catalogue. Cites a CVE in CISA KEV.
- Wed 26 Aug, 05:50 UTC. SecurityWeek, its first report on the story. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28. Cites a CVE in CISA KEV.
- Wed 26 Aug, 09:45 UTC. Security Affairs, its first report on the story. CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List. Cites a CVE in CISA KEV.
- Wed 26 Aug, 14:26 UTC. CISA. CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching. Cites a CVE in CISA KEV.
- Mon 31 Aug, 02:31 UTC. SecurityOnline. Weekly CVE Report: 11 Exploited Flaws Added to KEV. Cites a CVE in CISA KEV.
- Tue 15 Sep, 04:41 UTC. SecurityOnline. Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 29 Jul 10:11 | SecurityOnline | CVE-2026-60004: Gitea RCE lets attackers run code via Git hook |
| 25 Aug 22:43 | CISA | CISA Flags Gitea Code Injection Flaw in KEV Catalogue |
| 26 Aug 05:50 | SecurityWeek | CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28 |
| 26 Aug 09:45 | Security Affairs | CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List |
| 26 Aug 14:26 | CISA | CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching |
| 31 Aug 02:31 | SecurityOnline | Weekly CVE Report: 11 Exploited Flaws Added to KEV |
| 15 Sep 04:41 | SecurityOnline | Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data |
- Weekly CVE Report: 11 Exploited Flaws Added to KEVSecurityOnline · mentions it in passing
- CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt PatchingCISA · official notice
- CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit ListSecurity Affairs
- CISA Flags Gitea Code Injection Flaw in KEV CatalogueCISA · official notice
- CVE-2026-60004: Gitea RCE lets attackers run code via Git hookSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.