Forgejo instance compromised via unpatched CVE-2026-60004 RCE vulnerability in EOL version

The incident demonstrates how quickly known vulnerabilities can be weaponized against unpatched systems. The attacker exploited CVE-2026-60004 within days of its disclosure, targeting a Forgejo instance running an unsupported version. This aligns with common attack patterns where adversaries scan for and exploit recently disclosed vulnerabilities in outdated software. The postmortem reveals that the maintainer had no automated update mechanism for Forgejo, relying instead on manual checks of versioned image tags. This gap in update hygiene left the system exposed for months after the version reached EOL.

The attack vector combined two misconfigurations: an unpatched vulnerability and open sign-ups. The maintainer assumed sign-ups were disabled, but this setting was either overlooked or incorrectly configured. This allowed the attacker to create a user account, upload a malicious repository with a Git hook, and trigger the RCE. The exploit itself was a modified version of the published proof-of-concept, with added obfuscation and a second-stage payload. The second-stage script targeted system resources, killing high-CPU processes and disabling antivirus-like protections, likely to evade detection while deploying further malware.

The postmortem highlights operational gaps in homelab security practices. The maintainer used automated update checks for other containers via `latest` image tags but did not apply the same rigor to Forgejo due to its versioned tags. This inconsistency is common in self-hosted environments where convenience often trumps security. The incident also underscores the risks of running EOL software, even in non-critical systems. While the maintainer had monitoring in place (Komodo for CPU usage), the delay in noticing the spike allowed the attacker to persist for nearly 24 hours. This suggests that monitoring alone is insufficient without timely response procedures.

The technical analysis of the exploit provides actionable insights for engineers. The diff between the published POC and the attacker's script reveals minor but critical modifications, such as the addition of a `curl` command to fetch a second-stage payload. The second-stage script's behavior, targeting high-CPU processes and antivirus tools, indicates a focus on evasion and resource hijacking. Engineers can use this information to harden their systems by monitoring for similar Git hook abuses, restricting repository permissions, and implementing network-level controls to block unexpected outbound connections. The incident also serves as a reminder to validate configurations, such as sign-up settings, even in trusted environments.