Your Git server is production infrastructure. Attackers knew it before your security team did.
CVE-2026-60004 — critical code injection in Gitea, CVSS 9.8. CISA added it to the KEV catalog on August 25 after confirmed exploitation in the wild. More than 8,300 internet-exposed instances are still unpatched.
WHAT ACTUALLY HAPPENED
The flaw abuses Gitea's diffpatch endpoint. An attacker with ordinary repository write access can plant an executable Git hook and run arbitrary shell commands as the Gitea service account.
Write access to any repository. That is the entire bar.
A documented incident shows how low that bar really is. A self-hosted Gitea server was running an outdated version with open user registration, no email confirmation and no CAPTCHA. An automated scanner registered its own account, created its own repository, triggered the exploit chain and dropped crypto-mining software. No phishing. No stolen credentials. No human on the other end.
The fix shipped in Gitea 1.27.1 on July 27, with the advisory published the next day. CISA gave federal agencies until August 28 to remediate. Thousands of servers missed both dates.
WHY DEV INFRASTRUCTURE IS THE SOFTEST CROWN JEWEL
Self-hosted Git usually gets stood up by engineering, not IT. It ends up outside the patch cycle, outside the asset inventory, outside EDR — and often with open registration left enabled from day one because someone called it "internal".
But that box holds your source code, your CI credentials, your deployment keys and your infrastructure-as-code.
A crypto-miner is the lucky outcome. The same access lets an attacker modify a repository, poison a build, or read every secret ever committed to history. From there the compromise travels down the pipeline into production, carried by your own automation and signed off by your own CI.
Nobody ranks their Git server as tier-one infrastructure. Every attacker does.
WHAT TO DO NOW
UPGRADE TO GITEA 1.27.1 OR LATER — exploitation is confirmed and thousands of instances remain exposed a month after the fix shipped.
DISABLE OPEN REGISTRATION — if strangers can create accounts on your code platform, "authenticated write access" is not a control.
TAKE IT OFF THE PUBLIC INTERNET — put self-hosted Git behind VPN or zero trust access instead of a public IP and a login page.
AUDIT HOOKS, REPOS AND SECRETS — review recent Git hooks, unexpected commits, new accounts and outbound connections, and rotate every credential the service account could read.
The pipeline that builds your software is part of your software.
Who patches your source control platform — security, or the team that installed it four years ago?