Gitea RCE Hits CISA KEV: Self-Hosted Git Needs Faster Patching

CISA added CVE-2026-60004, a Gitea code-injection vulnerability, to the Known Exploited Vulnerabilities catalog on August 25, 2026. Gitea's own advisory says the issue affects versions from 1.17 up to, but not including, 1.27.1. The patched version is 1.27.1.

The risk is serious because self-hosted Git platforms often sit next to CI/CD systems, deployment keys, OAuth credentials, webhooks, container registries, and production secrets. If attackers get command execution as the Git service account, the immediate damage may not stop at the repository.

What operators should do

Teams running Gitea should update to 1.27.1 or later and treat exposed instances as potential incident-response cases, especially if open registration was enabled. A patch closes the known route, but it does not prove the server was clean before the update.

• Upgrade Gitea immediately if it is below 1.27.1.
• Disable open registration unless there is a strong business reason.
• Review new users, repositories, hooks, webhooks, OAuth apps, and access tokens.
• Rotate secrets that may have been readable by the Gitea service account.
• Check CI runners and deployment targets for unexpected jobs.
• Restrict what the Git service account can reach on the host and network.

BillioPlus MCP angle

Developer tools are part of the MCP threat surface because they often hold the keys used to build, deploy, and administer services. A compromised Git server can become a path to Cloudinary credentials, database URLs, MCP admin keys, or production environment variables.

The safest pattern is separation. Source control should not run as an all-powerful machine identity. CI/CD secrets should be scoped, short-lived where possible, and rotated after credible exposure.

Source links

• CISA: Adds one known exploited vulnerability to catalog
• Gitea security advisory for GHSA-rcr6-4jqh-j84m