Gitea RCE Flaw Actively Exploited in Cryptojacking Attacks

CISA added CVE-2026-60004, a critical Gitea code injection flaw, to its KEV catalog after active exploitation. The vulnerability allows authenticated users with repository write access to execute shell commands via the diffpatch API endpoint. Gitea patched it in version 1.27.1, and federal agencies must patch by August 28.