project
Gitea is an open-source, self-hosted Git service for repository hosting, code review and CI/CD via its built-in Actions runner.
No evidence-backed relationships are recorded.
CVE-2026-60004 turns Gitea's diffpatch API into remote code execution for anyone who can register an account. The fix is three steps, and CISA's federal deadline is August 28, 2026.
Reality
Gitea shipped a fix for CVE-2026-60004 on July 27 and CISA gave federal agencies until August 28, yet a month later Shadowserver still counts 8,393 exposed instances, and on shipped defaults the bug needs no credentials.
Perspective Coverage
7 publishersReality
GreyNoise traced scans from a single IP address, running since early June 2026, to a Chinese-speaking actor that breached 49 organizations through WordPress Core and stripped configs and root hashes from 996 ZyXEL switches.
Reality
GitHub's published post-mortem traces two hours of site-wide failure on September 13 to a data-cleanup job whose only brake measured replica lag, on the cluster holding permission data that nearly every authenticated request reads.
Reality
Acronis attributes exploitation of CVE-2026-60004 to a China-linked cluster that automated a published proof-of-concept from July 29, scanned 1,386 self-hosted Gitea servers and left a Linux rootkit behind.
Reality
Gitea's diffpatch flaw needs repository write access, which open self-registration hands to strangers. The awkward part is that the only patched build sits in the 1.27 family, so teams pinned to 1.26.x cannot fix this in place.
Reality
A published Git process makes one step unskippable: testing the release-candidate branch before it lands in master. CI/CD, by the author's own account, is optional.
Reality
A CNCF blog account reports a self-upgrading K3s control plane on Kairos with etcd quorum intact. The instructive part is that both bugs were in the automation, not the OS.
Reality