CISA Adds Gitea Code Injection Flaw to KEV Catalog
Code injection on a self-hosted Git server meets BOD 26-04's "total control" threshold: patching isn't optional for agencies, and contractors running Gitea face the same risk.
TL;DR
CISA added CVE-2026-60004, a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The addition triggers BOD 26-04 remediation requirements for FCEB agencies: because code injection on a Git server grants total control of the asset post-exploitation, agencies must prioritize patching and investigate whether threat actors compromised systems before the fix was applied. Gitea is widely deployed as a self-hosted Git service across government and contractor environments. This one lands in places where source code and CI/CD pipelines are the prize.
The vulnerability, CVE-2026-60004, is a code injection flaw in Gitea, the self-hosted Git service that's become the default for organizations that can't or won't put source code on GitHub or GitLab's cloud. That includes a significant slice of federal agencies and defense contractors running on-prem infrastructure. Code injection on a Git server isn't just another RCE. It's the keys to every repository and CI/CD secret the server manages. If an attacker has active exploitation working, the blast radius on a single unpatched Gitea instance is the organization's entire codebase.
Under BOD 26-04, the KEV listing triggers specific obligations. The directive distinguishes vulnerabilities that grant "total control of the asset post-exploitation" from lower-risk items. Code injection on a source control server lands squarely in the first bucket. FCEB agencies must patch rapidly and, critically, investigate whether threat actors compromised the system before the patch was applied. That investigation requirement is the piece most compliance checklists miss.
For contractors, BOD 26-04 doesn't apply directly. But the KEV listing is the closest thing CISA gives to a "patch this now" signal. Organizations subject to NIST SP 800-171 or CMMC should treat CVE-2026-60004 as a critical patch priority. If your Gitea instance isn't patched yet, Monday starts here. Bring your incident response plan: active exploitation means some organizations are already compromised.
Published ·Updated ·Deep Fathom