CISA KEV Addition: Gitea Code Injection Vulnerability (CVE-2026-60004)

Technical Analysis

CVE-2026-60004 is a code injection vulnerability in Gitea, a self-hosted Git service platform, that has been confirmed as actively exploited in the wild. Code injection flaws in Git hosting platforms typically allow attackers to achieve remote code execution on the underlying server, often via malicious repository content, hooks, webhooks, or crafted commit/branch metadata that is improperly sanitized before execution. Successful exploitation can grant an attacker full control over the Gitea host, exposing source code repositories, CI/CD secrets, SSH keys, and any tokens or credentials stored in the environment. Because many organizations use Gitea instances to host source repositories for AI agent frameworks, RAG pipelines, and LLM tool integrations—including stored API keys, model credentials, and pipeline configuration secrets—compromise of a Gitea server could directly expose agent infrastructure to credential theft, supply-chain tampering of agent code, or injection of malicious dependencies into agent build pipelines.

Affected Systems

Self-hosted Gitea instances running vulnerable versions affected by CVE-2026-60004; specific version ranges should be confirmed via the official Gitea security advisory and NVD/CVE record

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) published in this CISA alert; organizations should monitor Gitea server logs for anomalous repository operations, unexpected webhook/hook executions, and unauthorized process spawning on Gitea hosts

Remediation Steps

1. 1

   Apply vendor patch

   Update Gitea to the patched version addressing CVE-2026-60004 as specified in the official Gitea security advisory.

2. 2

   Check for prior compromise

   Per BOD 26-04 guidance, review logs and system state to determine if the vulnerability was exploited before the patch was applied, including checking for unauthorized code, webhooks, or user accounts.

3. 3

   Restrict public exposure

   Limit or remove public internet access to Gitea instances where feasible, placing them behind VPN or zero-trust access controls.

4. 4

   Rotate credentials and secrets

   Rotate SSH keys, API tokens, and any CI/CD or agent-related secrets stored in or accessible from the affected Gitea instance.

5. 5

   Audit agent pipeline dependencies

   Review any AI agent, RAG, or LLM tool codebases hosted on the affected Gitea server for signs of tampering or unauthorized commits.

6. 6

   Follow KEV catalog prioritization

   FCEB agencies must remediate per BOD 26-04 timelines; all organizations are encouraged to prioritize this KEV entry in vulnerability management programs.