Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog, warning that attackers are actively using this critical remote code execution flaw in Gitea. Discovered by researcher Shai Rod, the vulnerability affects all versions from 1.17 onward and allows anyone with write access to a repository to execute arbitrary shell commands as the Gitea service user.

Because open registration is often enabled by default, unauthenticated users can easily gain the necessary write privileges to trigger the exploit via the diffpatch endpoint. Recent incident reports indicate threat actors are leveraging this bug to deploy cryptocurrency-mining payloads onto compromised servers. Administrators must urgently upgrade to version 1.27.1 to mitigate the risk.