Thousands of teams self-hosting Gitea to retain control of their code are discovering their forge is vulnerable to remote code execution. The real issue: no one patches the "peripheral" tools.

8,300 Gitea forges exposed to RCE: Is your source code on the list?

What's happening

Gitea - the lightweight open-source Git forge, an alternative to GitHub for those who want to keep their code under control - is affected by a remote code execution vulnerability. The chilling detail: by scanning the internet, researchers identified over 8,300 vulnerable Gitea instances still exposed and unpatched.

A compromised Git forge is the nightmare scenario for supply chain security: the attacker gains access to all hosted source code, deployment keys, secrets stored in repositories, and webhooks connected to CI/CD pipelines. A gateway to the entire development infrastructure.

The forgotten forge syndrome

Gitea is popular precisely because it is simple to install and lightweight to run. The direct consequence: many instances are set up in minutes, then forgotten - accessible from the internet, unpatched, with no security monitoring.

The typical profile of a vulnerable instance: installed months ago for a project, the team continued working on it, but no one has integrated Gitea security updates into the maintenance cycle - because "it's just a versioning tool."

Concrete risks for a compromised forge:

• Complete exfiltration of source code (including private repositories)
• Injection of backdoors into code or CI/CD pipelines
• Theft of secrets stored in config files or environment variables
• Access to SSH keys of deployers registered in the interface

What to do now

To do now

1. Check your Gitea version: admin interface → About, or gitea -version. The patched version is listed in Gitea's release notes on GitHub.
2. Update immediately - download the latest stable version, replace the binary, restart the service.
3. Assess exposure: is your instance accessible from the internet? If so and it's not essential, move it behind a VPN or IP firewall rule.
4. Scan for exposed secrets: truffleHog or gitleaks to detect credentials in your repository history.
5. Check your webhooks and CI integrations: an attacker who gained access may have added discreet webhooks - take a full inventory.
6. Set up security monitoring: subscribe to Gitea releases on GitHub (Watch → Releases only) to avoid missing critical patches.