Nothing says "welcome to your Monday" like discovering your self-hosted Git server has been quietly moonlighting as a cryptocurrency miner for a stranger on the internet. That's exactly what happened to at least one Gitea admin this month, and CISA is now telling federal agencies to fix it or else.

A Patch Endpoint That Patches Too Much

CVE-2026-60004, a code injection flaw in Gitea (CVSS 9.8), lets anyone with repository write access abuse the platform's diffpatch endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Because Gitea allows open self-registration by default, "anyone with write access" can mean literally anyone who signs up for an account and creates a repo. One documented case saw an attacker deploy a cryptomining dropper that pegged CPU usage above 70%, tripping the victim's hosting provider's abuse alarms.

Gitea patched the flaw quietly in version 1.27.1 back in late July, but CISA didn't add it to its Known Exploited Vulnerabilities catalog until August 25 — after real attacks started showing up in the wild. Federal agencies were given until August 28 to patch. Shadowserver still counts over 8,300 internet-exposed Gitea instances that haven't updated.

The Gap Between "Patched" and "Safe"

A month-long gap between "fix is available" and "fix is applied" is exactly the window attackers live in — patches don't protect anyone sitting in a browser tab they never opened. Self-hosted developer infrastructure is popular precisely because it's low-maintenance to stand up and, apparently, just as easy to forget to maintain.

The scarier detail isn't the cryptomining — that's just the payload someone bothered to use. A hook that can execute arbitrary shell commands on your Git server can just as easily exfiltrate your source code, inject malicious commits into your next deploy, or plant a backdoor nobody notices until it's someone else's incident report.

An unpatched Git server isn't a convenience you're saving time on — it's a to-do item quietly compounding interest.

Supply-chain gaps like this are exactly why we put together a security checklist for teams who'd rather find their own weak points before someone else does: grab the free guide here.

Source: The Hacker News