Gitea RCE CVE-2026-60004: Self-Hosted Git

Published September 12, 2026 — Singapore. A remote code execution vulnerability in Gitea, an open-source self-hosted Git service, was disclosed on August 27, 2026 by Triskelelabs as CVE-2026-60004. The vulnerability allows attackers to execute arbitrary code on the Gitea server, potentially compromising source code repositories and CI/CD credentials. Gitea is widely deployed by enterprises and developer teams as a lightweight self-hosted GitHub alternative.

Data last verified September 12, 2026 from Triskelelabs' Gitea CVE-2026-60004 advisory (August 27, 2026), Gitea GitHub Security Advisories, and cybersecurity best practices.

Quick Answer

CVE-2026-60004 is a remote code execution vulnerability in Gitea, an open-source self-hosted Git service, disclosed August 27, 2026. The vulnerability allows attackers to execute arbitrary code on the Gitea server. Gitea is used by enterprises with data sovereignty requirements, government agencies, and developer teams as a GitHub alternative. Successful exploitation compromises source code repositories and CI/CD credentials. Patch immediately; rotate any secrets stored in or accessible from the Gitea server (Triskelelabs, August 27, 2026; Gitea, 2026).

What is Gitea?

Gitea is an open-source, lightweight Git service that organizations self-host as a GitHub alternative. Key features and deployment patterns:

Source: Gitea documentation (2026).

Gitea is particularly popular in: European enterprises (data sovereignty requirements), government agencies (FedRAMP-style requirements), and developer teams that prefer lightweight, customizable Git platforms (Gitea, 2026).

The attack surface of a Gitea instance

A typical Gitea instance has significant attack surface:

• Git server: SSH or HTTPS access for Git push/pull operations.
• Web interface: HTTP/HTTPS for the Gitea UI.
• API: REST API for automation and integrations.
• Webhooks: outbound HTTP/HTTPS to CI/CD systems.
• OAuth integrations: client secrets to third-party services.
• Database: PostgreSQL, MySQL, SQLite, or MSSQL backend.
• File storage: repositories, attachments, LFS objects on local disk or object storage.

An RCE on the Gitea server grants attackers access to most of these surfaces, with the ability to read source code, exfiltrate credentials, and pivot to connected systems (Gitea security advisories, 2026).

CVE-2026-60004: exploit chain and impact

The exact exploit chain for CVE-2026-60004 will be detailed in Triskelelabs' advisory and the Gitea GitHub Security Advisory. Typical Gitea RCE patterns observed in 2024-2026 vulnerabilities:

1. Webhook manipulation: Gitea webhooks execute HTTP callbacks on repository events. Manipulating webhook payloads can trigger code execution if the webhook target is a vulnerable CI/CD system or the webhook URL contains an attacker-controlled payload.
2. Git hook abuse: Gitea supports server-side Git hooks (pre-receive, post-receive, update). If an attacker can write to a repository's hooks directory, they can execute arbitrary code on the Gitea server when Git operations occur.
3. API file upload: the Gitea API allows file uploads. Exploiting file upload validation can place executable files in web-accessible directories.
4. Template injection: Gitea's templating engine (for issues, pull requests, notifications) may allow template injection that leads to code execution.
5. Authentication bypass: combining CVE-2026-60004 with an authentication bypass vulnerability can enable unauthenticated RCE.

The downstream impact of a successful Gitea RCE:

• Source code theft: all repositories on the Gitea instance are exposed.
• Source code tampering: attackers can modify source code to inject backdoors, supply-chain attacks.
• CI/CD credential theft: deploy keys, registry credentials, cloud access keys stored in Gitea or accessible from it.
• Database compromise: the Gitea database contains user accounts, SSH keys, OAuth tokens, and webhook configurations.
• Lateral movement: from Gitea to connected systems (Kubernetes clusters, cloud accounts, internal services).
• Persistent access: backdoors in the Gitea binary, configuration, or web root.

Immediate response for Gitea operators

1. Identify your Gitea version: the version is typically displayed in the Gitea UI footer or admin panel. For Docker deployments, check the image tag (e.g., gitea/gitea:1.22.x).
2. Check the security advisory: visit github.com/go-gitea/gitea/security/advisories for the CVE-2026-60004 advisory and patched version.
3. Upgrade Gitea: follow the standard Gitea upgrade procedure. Backup your data directory and database first.
4. Rotate secrets: all secrets stored in or accessible from Gitea should be rotated: webhook secrets, OAuth client secrets, deploy keys, database passwords, SSH keys.
5. Review access logs: check Gitea's access logs from August 2026 forward for unexpected admin actions, repository uploads, or webhook configurations.
6. Audit source code: compare source code in Gitea against upstream or known-good copies. Look for injected backdoors, modified binaries, or unexpected files.
7. Review CI/CD integrations: audit deploy keys, registry credentials, and CI/CD integrations for unexpected additions.
8. Engage incident response: if compromise is confirmed, engage your incident response retainer or a managed security service provider.

Defensive recommendations for Gitea deployments

Best practices for hardening self-hosted Gitea deployments:

• Network segmentation: isolate Gitea from the public internet. Use a VPN or zero-trust gateway for remote access.
• Patch promptly: subscribe to Gitea's GitHub Security Advisories and apply patches within 7 days of release.
• Web application firewall: deploy a WAF in front of Gitea to filter malicious requests.
• Database security: use a dedicated database user with minimum necessary privileges. Encrypt the database connection with TLS.
• Secret management: store webhook secrets, OAuth client secrets, and deploy keys in a dedicated secret management system (HashiCorp Vault, AWS Secrets Manager) rather than in Gitea configuration files.
• Audit logging: enable detailed Gitea audit logging and forward logs to a central SIEM.
• Backup posture: maintain offline backups of Gitea data with periodic restore testing.
• Two-factor authentication: require 2FA for all Gitea admin users and enforce for new users.
• Repository signing: use GPG-signed commits and tags to detect source code tampering.

The broader Git server threat landscape

Gitea is one of several Git servers facing active security threats. Comparable recent incidents:

Source: CISA Known Exploited Vulnerabilities catalog; Git server vendor advisories (2022-2026).

Git servers are high-value targets because they hold source code (the intellectual property of an organization) and CI/CD credentials (which can be used to deploy backdoored code). The attack surface is broad (Git protocol, web UI, API, webhooks, integrations), and the development team's trust in the Git server makes it a high-yield target.

FAQ

How does Gitea differ from GitLab?
Gitea is a lightweight, single-binary Git service focused on core Git hosting and code review. GitLab is a comprehensive DevOps platform with built-in CI/CD, container registry, monitoring, and security scanning. Gitea requires less resources and is easier to self-host; GitLab offers more integrated features but with greater complexity and attack surface (Gitea; GitLab, 2026).

Should I migrate from Gitea to a hosted service?
Not necessarily. Self-hosted Gitea is appropriate for organizations with data sovereignty, compliance, or specific customization requirements. The CVE-2026-60004 vulnerability is patchable. Migration to hosted GitHub/GitLab would address the self-hosted patching burden but introduce other concerns: data sovereignty, vendor lock-in, and per-user pricing. For most organizations, prompt patching and hardening of self-hosted Gitea is the right response (Gitea, 2026).

Will the Gitea CVE-2026-60004 vulnerability be added to CISA KEV?
Whether CISA adds CVE-2026-60004 to the Known Exploited Vulnerabilities catalog depends on whether active exploitation is confirmed. Triskelelabs typically discloses whether exploitation is observed in the wild. Even if not added to KEV, organizations should treat the vulnerability as critical and patch immediately given the RCE nature and the supply-chain risk to source code and CI/CD credentials (CISA, 2026).