--- title: My Homelab Got Hacked - A Postmortem | daily.dev description: A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker... canonical: https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: My Homelab Got Hacked - A Postmortem | daily.dev og:description: A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker... og:url: https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw og:image: https://api.daily.dev/og/posts/DlHslsoqW.png og:image:alt: My Homelab Got Hacked - A Postmortem og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # My Homelab Got Hacked - A Postmortem **[Lobsters](https://daily.dev/sources/lobsters)** · 10 min read · 1 upvotes · 0 comments ## Summary A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker exploited an open sign-up form (which the author thought was disabled) and an outdated, EOL v13 image tag to create a malicious repo with a Git hook that downloaded and executed a cryptocurrency miner. The postmortem walks through log analysis, the exploit's similarity to a public GitHub POC and Nuclei template, and remediation steps: rolling back to a clean backup, upgrading to v16, disabling open signups and local auth, and plans to restrict per-container network access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-60004 and how does it allow remote code execution in Forgejo or Gitea? CVE-2026-60004 is a remote code execution vulnerability in Gitea's (and thus Forgejo's) diffpatch API endpoint that lets an attacker push a malicious Git post-index-change hook script to gain code execution on the server. Exploitation involves signing up for an account, creating a repo with the crafted hook, then sending at least two POST requests to /api/v1/repos/USER/REPO/diffpatch to trigger it. It was patched in the latest v15 LTS and v16 releases of Forgejo. _Track Gitea and Forgejo security advisories on daily.dev before an unpatched RCE turns into a live incident._ ### Why would pinning a Docker image to a specific version number leave a self-hosted git server vulnerable to attack? Because Forgejo does not publish a rolling latest image tag, a container pinned to a specific version like v13 will never surface an available-update notification the way latest-tagged containers do, so it can silently sit on an end-of-life release long after a critical patch ships. In one case a v13 instance stayed vulnerable to a diffpatch RCE for six months after v13 reached end of life in January 2026. _Developers self-hosting pinned container versions can watch for EOL and CVE alerts through daily.dev._ ### What does malware do after exploiting a git server RCE to deploy a crypto-miner payload? After gaining code execution, the second-stage shell script kills processes with guard in the name and any process using over 80% CPU (evading antivirus and rival miners), disables their systemd entries, picks a writable download location among /tmp, HOME, and PWD, detects CPU architecture, downloads an architecture-specific binary via curl, wget, Python, or Perl fallbacks, then executes it in memory and deletes the file from disk. VirusTotal identified the resulting binaries as known crypto-miners. _Homelab operators hardening against post-exploitation payloads can follow security writeups like this via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 8 comments across lobsters, hackernews (as of 2026-09-14). **TL;DR:** Discussion focuses on whether the CVE should have been separately attributed to Forgejo, and pivots into a broader debate about homelab security practices like network isolation, authenticating proxies, and choosing image tags with longer security-update windows. **Sentiment:** 15% positive · 45% mixed · 40% skeptical **The case for** - The write-up is seen as a typical, relatable homelab scenario worth reading more of. - The impact was low, and high-CPU alerts from cryptojacking are viewed as an inadvertent, low-cost intrusion detection signal. - Gating access through a single authenticating reverse proxy is praised as simpler and reduces password/session fatigue across services. **The pushback** - Some feel the CVE should have been filed separately for Forgejo rather than just inherited from Gitea. - Pinning to the v13 tag was avoidable since the LTS-style tag offers security updates for far longer (~28 months vs 4). - Only exposing services with automated security updates is suggested as a useful but restrictive invariant that rules out a lot of software choices. **By community** - lobsters (mixed): Commenters debate CVE attribution and offer practical homelab hardening advice, from proxy-based auth to network isolation, with a generally constructive, sympathetic tone toward the author. - hackernews (mixed): No substantive comment content was provided for this discussion. **Hottest debate:** Whether the vulnerability should have been assigned its own CVE for Forgejo instead of relying on the upstream Gitea CVE. **Open questions** - Was the author's CI runner privileged enough to expose secrets during the compromise? - Should Forgejo track and disclose its own CVEs separately from Gitea's? **Highlights** > > I quickly found CVE-2026-60004, a recently-disclosed RCE vulnerability in Gitea, upon which Forgejo is based This is a CVE related to gitea, I realize forgejo might be related, but I feel like this should have its own CVE for forgejo as well. I just put up my own forgejo instance yesterday so seeing this news that their forgejo instance got popped doesn't make me feel great. As a result of this, I subscribed to the rss feed available on https://codeberg.org/forgejo/security-announcements/issues which should at least notify me of when I need to patch something. > — [thomas0 on lobsters · 7 points, 1 comments](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_9stwhb) > Nice write-up! This feels like a pretty typical homelab setup, I assume this thing happens a lot. I'd love to read more of them! I think we all recognise our homelabs aren't that secure, and as you the author notes, there's things that could be done, but some at the cost of lots of complexity. The good news is that it looks like the impact of this was pretty low. Thanks to cryptojacking that "high CPU" alerts are now a low-cost way to be alerted of running vulnerable software. I hear some cryptojackers patch CVEs too. "Friendly gut bacteria". The author is lucky that this didn't happen at the same time as one of the many recent local root exploits. Forgejo can store secrets for CI runners and that's often a reason someone chooses to self-host, so I'm curious if the author's CI was privileged in this way. > Unfortunately, Forgejo only offers versioned image tags, meaning no latest tag. I still had mine pinned to v13 which reached EOL 6 months ago in January, 2026. > [...] > I'm trying to K.I.S.S. (Keep It Simple, Stupid) in my homelab. I think "only expose services that have automated security updates" is a useful KISS invariant. It rejects a lot of software though. https://lobste.rs/s/21lrrw/gitolite discusses lighter git options. Forgejo v13 received security updates for 4 months. I see the LTS gets updates for ~28 months. Perhaps a safer bet if someone needs Forgejos featureset. https://forgejo.org/docs/latest/admin/release-schedule/ I don't trust applications to not have endpoints that are weakly authenticated, and have exploits, so another invariant I like for exposed services is "all requests are authenticated" by an authenticating proxy. For me that's Caddy (mTLS or basic auth), oauth2-proxy, or OpenSSH, depending on the application. I make an exception here for "unauthenticated read-only services" like static web servers. That said, I don't have much on my homelab due to these invariants. There's something to be said for KISS by ignoring all of the above. :) > — [tuxes on lobsters · 1 points, 2 comments](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_rt2ddo) > Yes, if you use the `15` tag, you get automatic security updates until EOL in July 2027. https://codeberg.org/forgejo/-/packages/container/forgejo/15 > — [oliverpool on lobsters · 1 points](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_9owepl) > Shouldn't Forgejo be added to the existing CVE instead of creating a new CVE? > — [val on lobsters · 1 points](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_z73lsr) > My lab network is hardwired and has no direct route to the Internet. Anything that wants out has to go through a proxy (and anything that wants in has to go through the reverse proxy or the bastion host). I may be a bit paranoid. > — [classichasclass on lobsters · 1 points, 1 comments](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_gjljob) **Source threads** - [lobsters](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem) · 42 points · 8 comments - [hackernews](https://news.ycombinator.com/item?id=49251087) · 7 points · 0 comments ## Similar posts on daily.dev - [Hackers now exploit critical Gitea flaw in code injection attacks](https://daily.dev/posts/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks-gmz4nkjzi) · BleepingComputer · 2 upvotes · 0 comments - [Over 8,300 Gitea servers vulnerable to code execution attacks](https://daily.dev/posts/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks-rbh2jcepp) · BleepingComputer · 1 upvotes · 0 comments - [Yet another RCE in Gogs, but it's fixed this time\!](https://daily.dev/posts/yet-another-rce-in-gogs-but-it-s-fixed-this-time--qp2hfojhz) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#self-hosting](https://daily.dev/tags/self-hosting), [#forgejo](https://daily.dev/tags/forgejo) [View this post on daily.dev](https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"My Homelab Got Hacked - A Postmortem","url":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw"},"datePublished":"2026-08-12T22:40:50.733Z","dateModified":"2026-09-14T06:54:07.162Z","description":"A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b1f1f0c25b7b4a64c506b7fc47280642?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b1f1f0c25b7b4a64c506b7fc47280642?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,docker,self-hosting,forgejo","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"My Homelab Got Hacked - A Postmortem"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-60004 and how does it allow remote code execution in Forgejo or Gitea?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-60004 is a remote code execution vulnerability in Gitea's (and thus Forgejo's) diffpatch API endpoint that lets an attacker push a malicious Git post-index-change hook script to gain code execution on the server. Exploitation involves signing up for an account, creating a repo with the crafted hook, then sending at least two POST requests to /api/v1/repos/USER/REPO/diffpatch to trigger it. It was patched in the latest v15 LTS and v16 releases of Forgejo. Track Gitea and Forgejo security advisories on daily.dev before an unpatched RCE turns into a live incident."}},{"@type":"Question","name":"Why would pinning a Docker image to a specific version number leave a self-hosted git server vulnerable to attack?","acceptedAnswer":{"@type":"Answer","text":"Because Forgejo does not publish a rolling latest image tag, a container pinned to a specific version like v13 will never surface an available-update notification the way latest-tagged containers do, so it can silently sit on an end-of-life release long after a critical patch ships. In one case a v13 instance stayed vulnerable to a diffpatch RCE for six months after v13 reached end of life in January 2026. Developers self-hosting pinned container versions can watch for EOL and CVE alerts through daily.dev."}},{"@type":"Question","name":"What does malware do after exploiting a git server RCE to deploy a crypto-miner payload?","acceptedAnswer":{"@type":"Answer","text":"After gaining code execution, the second-stage shell script kills processes with guard in the name and any process using over 80% CPU (evading antivirus and rival miners), disables their systemd entries, picks a writable download location among /tmp, HOME, and PWD, detects CPU architecture, downloads an architecture-specific binary via curl, wget, Python, or Perl fallbacks, then executes it in memory and deletes the file from disk. VirusTotal identified the resulting binaries as known crypto-miners. Homelab operators hardening against post-exploitation payloads can follow security writeups like this via daily.dev."}}]} ```