How to install CISA Warns of Exploited Gitea Vulnerability

What happened

The Cybersecurity and Infrastructure Security Agency has added a Gitea remote code execution vulnerability to its Known Exploited Vulnerabilities catalog, meaning federal agencies must act and private organizations should treat it as an urgent operational matter. Gitea is a self-hosted Git service used by development teams worldwide to manage source code repositories, and a compromise of a Gitea instance can expose every codebase, credential, and secret stored inside it.

This guide walks you through understanding the vulnerability and upgrading your Gitea installation to the patched release. The steps are written for administrators who manage their own Gitea servers, whether on bare metal, virtual machines, or containers. Read through the full guide before touching anything in production.

CVE-2026-60004 is a remote code execution vulnerability in Gitea. Gitea developers patched it in late July with the release of version 1.27.1. CISA has since confirmed that the vulnerability is being actively exploited in the wild, which is the agency's threshold for adding an issue to the Known Exploited Vulnerabilities catalog. Active exploitation means attackers are not simply testing the waters — they are running real attacks against reachable Gitea instances right now.

How it works

Any organization running a Gitea instance on a version prior to 1.27.1 is exposed. This includes instances that are publicly reachable on the internet as well as those on internal networks, because remote code execution vulnerabilities can be triggered by anyone who can reach the service over a network connection, and internal network access is often achievable through phishing, VPN compromise, or lateral movement. If your Gitea instance is behind authentication, that reduces the attack surface but does not eliminate it, because the vulnerability is classified as remote code execution and the exact authentication requirements remain partially unclear at this time.

First, find out what version of Gitea you are currently running. Log in to your Gitea instance as an administrator and navigate to the site administration panel, where the version number is displayed. You can also run the Gitea binary directly with a version flag from the command line on the host server to get this information. If the version shown is anything lower than 1.27.1, treat your instance as compromised until proven otherwise and begin the upgrade immediately.

Why it matters

Download version 1.27.1 from the official Gitea releases page at gitea.com. Match the binary to your operating system and architecture exactly. Before upgrading, take a full backup of your Gitea data directory and your database. The data directory typically contains repositories, attachments, and configuration, and the database holds users, issues, and metadata. Gitea's documentation describes the exact paths for each deployment style. Do not skip the backup step — even a routine upgrade can go wrong, and you want a recovery path.

Stop the running Gitea service before replacing any files. On systems using systemd, stop the service unit. On Docker deployments, stop and remove the container before pulling the new image. Replace the old binary or image with the 1.27.1 version, then restart the service. Gitea will run any necessary database migrations automatically on first start. Watch the application logs during startup to confirm it comes up cleanly and migrations complete without errors.

Who is affected

After the upgrade, verify the version number again in the administration panel to confirm 1.27.1 is active. Then review your access logs for unusual requests that may have occurred before the upgrade. Look for unexpected repository access, new user accounts you do not recognize, newly added SSH keys or access tokens, and any webhook or integration changes. If you see activity you cannot explain, assume the instance was compromised and escalate to your incident response process rather than continuing normal operations.

If you cannot upgrade immediately, consider taking the Gitea service offline entirely or restricting network access to it until the upgrade can be performed. Running a known-exploited service is a higher risk than a temporary outage.

What to watch next

CVE-2026-60004 allows a remote attacker to execute arbitrary code on the server hosting Gitea. Remote code execution at the server level means an attacker can read, modify, or delete any file the Gitea process has access to, install malware, establish persistent access, steal credentials and secrets from repositories, and pivot to other systems on the same network. The specific technical mechanism — whether it involves a crafted HTTP request, a malicious repository operation, or some other vector — has not been fully disclosed publicly, which is standard practice while administrators are still patching.

The full technical details of how CVE-2026-60004 is triggered have not been publicly released. It is not yet publicly confirmed whether exploitation requires any form of authentication or whether it is reachable by completely unauthenticated attackers. The scale of exploitation in the wild and which specific threat actors are using it also remain unclear. As Gitea and security researchers publish further analysis, those details will help organizations assess whether their pre-patch logs show signs of intrusion. Until then, the safest assumption is that any unpatched instance reachable over a network should be treated as a priority upgrade target.