Column 1
Column 2
Skip to content

Gitea CVE-2026-60004 KEV: Patch Self-Hosted Git Servers

August 25, 2026

CISA added Gitea CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on August 25, 2026. If you run a self-hosted Gitea server, move to the vendor’s patched 1.27.1 release or later. The current upstream release was 1.27.2 at review. Treat this as a focused maintenance task: identify exposed instances, use your approved update process, review trusted access, and verify the repository workflows your team relies on.

This is a defensive maintenance guide. It intentionally avoids technical attack detail and focuses on safe patching and operational verification.

Who should act now

  • Organizations running self-hosted Gitea for source control, pull requests, issue tracking, packages, or automation.
  • Teams with Gitea reachable from the internet, a corporate network, or a shared development environment.
  • Hosting and platform administrators responsible for the server, its reverse proxy, and repository access.

Update Gitea safely

  1. Identify every Gitea instance, its installed version, operating system, service account, and normal maintenance owner.
  2. Use the vendor-supported package, container, or binary update path already approved for that deployment. Do not change a backup schedule solely for this update.
  3. Update to Gitea 1.27.1 or later. Prefer the current supported upstream release when it fits your normal compatibility and change-control process.
  4. Review public exposure and limit administrative access to trusted networks and people wherever your operating model permits.
  5. Confirm that repository, organization, and automation permissions still follow least privilege after maintenance.

Verify normal service after the update

  • Confirm the running Gitea version in the administration area or your normal service inventory.
  • Check the expected Gitea web sign-in and authorized administrator access.
  • Use an approved account to confirm representative repository browsing, normal source-control activity, and expected automation or integration status.
  • Review ordinary service health, application logs, monitoring, and support channels for unexpected errors after the change.
  • Record the release installed, maintenance window, owner, and verification results for the environment.

Related hosting guidance

For a different Gitea deployment risk, see the existing Gitea Docker security guide. Administrators maintaining related hosting services can also use the WHM and cPanel hub. Teams that need help coordinating WordPress and hosting maintenance can start with WordPress support.

Sources