Gitea: unauthenticated remote code execution via the diffpatch API installing Git hooks

Impact

A self-hosted Gitea instance is usually where a GPU shop keeps training code, Dockerfiles, GitOps manifests and CI runner credentials. This flaw lets an unauthenticated caller reach the diffpatch API and install a Git hook, which the server then executes - so the attacker gets code execution as the Gitea service account on the git host. From there the practical damage is supply chain: poisoned image builds and manifests flow to the cluster on the next sync, and any deploy keys or CI tokens stored on that host are exposed. CISA lists it as exploited in the wild.

Who can reach it

Anyone able to reach the Gitea HTTP endpoint. No authentication required (CVSS PR:N), so an instance published to tenants or to the internet is directly exposed.

What to do

Upgrade to Gitea 1.27.1 as described in the release notes and GHSA-rcr6-4jqh-j84m, then restart the Gitea service - a single-daemon restart, no node drain and no cluster impact. Because exploitation leaves persistence behind, also inspect existing repositories for unexpected server-side hooks and rotate deploy keys, CI tokens and webhook secrets held by the instance.

References

Related entries

• JetBrains TeamCity: Deserialization in the agent polling protocolCVE-2026-63077 · JetBrains TeamCityCritical
• Windows iSCSI Target Service (Windows Server 2012 through Windows Server 2025 / Windows 10 1607+): Three heap-basedCVE-2026-65791 · Windows iSCSI Target Service (Windows Server 2012 through Windows Server 2025 / Windows 10 1607+)Critical
• Linux SUNRPC (xdr_buf_to_bvec, nfsd write path): xdr_buf_to_bvec stores a bio_vec before checking the slot is in rangeCVE-2026-72217 · Linux SUNRPC (xdr_buf_to_bvec, nfsd write path)Critical
• Linux VXLAN driver (transmit-path header pulls): `vxlan_xmit()`, `arp_reduce()` and `vxlan_mdb_entry_skb_get()`CVE-2026-74474 · Linux VXLAN driver (transmit-path header pulls)Critical
• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical
• BeeGFS (beegfs-ctl / metadata server): Authentication bypass by talking directly to a BeeGFS metadata server. BeeGFS isCVE-2019-15897 · BeeGFS (beegfs-ctl / metadata server)Critical