Gitea's diffpatch RCE: self-hosted Git is supply-chain surface

CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue on August 25 and gave federal agencies until August 28 to patch. The bug is in Gitea, the self-hosted Git service a lot of small teams run because it is light and free. It scores CVSS 9.8, it is being exploited in the wild, and the observed payload so far is crypto-mining, which means opportunists found it first.

What the bug does

An attacker with write access to a repository sends a crafted patch to Gitea's diffpatch API endpoint. The patch plants an executable Git hook. The next time the hook fires, the attacker's commands run in a shell under the Gitea service account. That is full remote code execution on the host, with whatever that service account can reach.

The fix shipped in Gitea 1.27.1 at the end of July. Most self-hosted Git does not update on a schedule, so the window has been open for a month.

The qualifier "write access to a repository" sounds like a high bar. It is not. Gitea ships with self-registration enabled by default. An external attacker creates an account, creates a repository, and now has write access to a repository. Roughly 5,000 instances are reachable from the public internet.

Why a Git server is a supply-chain problem

Think about what is adjacent to the Gitea process. Deploy keys. The CI runner's token, often in an environment variable or a config file the service account can read. SSH keys for mirrors. Webhooks into the build system. The repository that builds the container that runs in production. A Git server is the single point in most small shops where source, credentials and the path to production all sit on one box.

Code execution there is not a defaced website. It is a position from which an attacker can modify a commit, poison a build, or add a hook that runs on every push. The miners found it first. The next payload will be quieter.

The threat model for a self-hosted Git server is not that someone reads your code. It is that someone edits your build.

The same season, a second reminder

Gitea is not alone. PaperCut NG/MF has just issued its second emergency patch for CVE-2026-81578 and CVE-2026-82078, an authentication bypass chained into remote code execution, actively exploited, with roughly 1,000 instances exposed directly to the internet. Same pathology: internal infrastructure, rarely updated, reachable from more places than intended. Two weeks before Gitea, the ChainDrop npm worm on August 13 hit the other side of the same pipeline. The pattern is a series, not a coincidence.

Checklist for self-hosted dev infrastructure

• Upgrade Gitea to 1.27.1 or later today. CISA's deadline was for federal agencies; the exploit does not check who you are.
• Disable self-registration unless you have a documented reason for it. Every default-open registration form is an attacker's first write permission.
• Audit existing Git hooks in every repository on the server for anything you did not put there. A patched server still runs a hook planted before the patch.
• Check the service account's blast radius. What files can it read, what tokens are in its environment, which internal hosts can it reach? Trim it to the minimum, and rotate anything it could have exposed.
• Segment the network. Your Git server should not be one hop from the production database. The VLAN discipline I use for local AI hardware in IoT VLAN local AI applies to dev infrastructure just as well.
• Confirm exposure. If your instance answers on a public IP, put it behind VPN or an identity-aware proxy.
• Extend the review to coding agents. An agent with a deploy token on a compromised Git host is a second attacker; the isolation rules in sandboxing coding agents assume the Git server is trusted, and this week it is not.

The honest gap

The public reporting says actively exploited and crypto-mining but does not say how many of the 5,000 exposed instances were hit, whether any exploitation was targeted rather than opportunistic, or whether a stealthier payload has been observed. If your Gitea was reachable and unpatched in August, assume the hooks need reading, not just the changelog.