--- title: My Homelab Got Hacked - A Postmortem | daily.dev description: A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker... canonical: https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: My Homelab Got Hacked - A Postmortem | daily.dev og:description: A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker... og:url: https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw og:image: https://api.daily.dev/og/posts/DlHslsoqW.png og:image:alt: My Homelab Got Hacked - A Postmortem og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # My Homelab Got Hacked - A Postmortem **[Lobsters](https://daily.dev/sources/lobsters)** · 10 min read · 1 upvotes · 0 comments ## Summary A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker exploited an open sign-up form (which the author thought was disabled) and an outdated, EOL v13 image tag to create a malicious repo with a Git hook that downloaded and executed a cryptocurrency miner. The postmortem walks through log analysis, the exploit's similarity to a public GitHub POC and Nuclei template, and remediation steps: rolling back to a clean backup, upgrading to v16, disabling open signups and local auth, and plans to restrict per-container network access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-60004 and how does it affect Gitea and Forgejo? CVE-2026-60004 is a remote code execution vulnerability in Gitea's diffpatch API endpoint, which Forgejo inherited since it is based on Gitea. An attacker can push a malicious repository containing a crafted Git hook, then trigger the diffpatch endpoint to execute the hook and gain code execution on the server. The bug was patched in Gitea and in Forgejo's latest v15 LTS and v16 releases. _Track newly disclosed CVEs like this one on daily.dev before they hit an unpatched self-hosted instance._ ### How can I tell if my Forgejo or Gitea server was exploited by the diffpatch RCE? Check server logs for at least two POST requests to /api/v1/repos/USER/REPO/diffpatch, often preceded by a sign-up, repo creation, and branch check within a few seconds, indicating a scripted attack. Look for unexpected users with a single repo containing a README and a hooks folder with a post-index-change script that curls an external IP and executes a payload. _Developers auditing self-hosted git servers can follow incident writeups like this one on daily.dev._ ### Why was an old Forgejo container still vulnerable to a patched CVE? The instance was pinned to Forgejo v13, which reached end-of-life in January 2026, roughly six months before the exploit occurred, because Forgejo does not publish a 'latest' image tag and updates require manually checking versioned tags. The CVE had already been fixed in v15 LTS and v16, so staying on the outdated, unsupported v13 left the server exposed. _Keeping pinned container versions current is easier when you track EOL and security news for tools like Forgejo on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 8 comments across lobsters, hackernews (as of 2026-08-13). **TL;DR:** Discussion focuses on whether the CVE should have been separately attributed to Forgejo, and pivots into a broader debate about homelab security practices like network isolation, authenticating proxies, and choosing image tags with longer security-update windows. **Sentiment:** 15% positive · 45% mixed · 40% skeptical **The case for** - The write-up is seen as a typical, relatable homelab scenario worth reading more of. - The impact was low, and high-CPU alerts from cryptojacking are viewed as an inadvertent, low-cost intrusion detection signal. - Gating access through a single authenticating reverse proxy is praised as simpler and reduces password/session fatigue across services. **The pushback** - Some feel the CVE should have been filed separately for Forgejo rather than just inherited from Gitea. - Pinning to the v13 tag was avoidable since the LTS-style tag offers security updates for far longer (~28 months vs 4). - Only exposing services with automated security updates is suggested as a useful but restrictive invariant that rules out a lot of software choices. **By community** - lobsters (mixed): Commenters debate CVE attribution and offer practical homelab hardening advice, from proxy-based auth to network isolation, with a generally constructive, sympathetic tone toward the author. - hackernews (mixed): No substantive comment content was provided for this discussion. **Hottest debate:** Whether the vulnerability should have been assigned its own CVE for Forgejo instead of relying on the upstream Gitea CVE. **Open questions** - Was the author's CI runner privileged enough to expose secrets during the compromise? - Should Forgejo track and disclose its own CVEs separately from Gitea's? **Highlights** > > I quickly found CVE-2026-60004, a recently-disclosed RCE vulnerability in Gitea, upon which Forgejo is based This is a CVE related to gitea, I realize forgejo might be related, but I feel like this should have its own CVE for forgejo as well. I just put up my own forgejo instance yesterday so seeing this news that their forgejo instance got popped doesn't make me feel great. As a result of this, I subscribed to the rss feed available on https://codeberg.org/forgejo/security-announcements/issues which should at least notify me of when I need to patch something. > — [thomas0 on lobsters · 7 points, 1 comments](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_9stwhb) > Nice write-up! This feels like a pretty typical homelab setup, I assume this thing happens a lot. I'd love to read more of them! I think we all recognise our homelabs aren't that secure, and as you the author notes, there's things that could be done, but some at the cost of lots of complexity. The good news is that it looks like the impact of this was pretty low. Thanks to cryptojacking that "high CPU" alerts are now a low-cost way to be alerted of running vulnerable software. I hear some cryptojackers patch CVEs too. "Friendly gut bacteria". The author is lucky that this didn't happen at the same time as one of the many recent local root exploits. Forgejo can store secrets for CI runners and that's often a reason someone chooses to self-host, so I'm curious if the author's CI was privileged in this way. > Unfortunately, Forgejo only offers versioned image tags, meaning no latest tag. I still had mine pinned to v13 which reached EOL 6 months ago in January, 2026. > [...] > I'm trying to K.I.S.S. (Keep It Simple, Stupid) in my homelab. I think "only expose services that have automated security updates" is a useful KISS invariant. It rejects a lot of software though. https://lobste.rs/s/21lrrw/gitolite discusses lighter git options. Forgejo v13 received security updates for 4 months. I see the LTS gets updates for ~28 months. Perhaps a safer bet if someone needs Forgejos featureset. https://forgejo.org/docs/latest/admin/release-schedule/ I don't trust applications to not have endpoints that are weakly authenticated, and have exploits, so another invariant I like for exposed services is "all requests are authenticated" by an authenticating proxy. For me that's Caddy (mTLS or basic auth), oauth2-proxy, or OpenSSH, depending on the application. I make an exception here for "unauthenticated read-only services" like static web servers. That said, I don't have much on my homelab due to these invariants. There's something to be said for KISS by ignoring all of the above. :) > — [tuxes on lobsters · 1 points, 2 comments](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_rt2ddo) > Yes, if you use the `15` tag, you get automatic security updates until EOL in July 2027. https://codeberg.org/forgejo/-/packages/container/forgejo/15 > — [oliverpool on lobsters · 1 points](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_9owepl) > Shouldn't Forgejo be added to the existing CVE instead of creating a new CVE? > — [val on lobsters · 1 points](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_z73lsr) > My lab network is hardwired and has no direct route to the Internet. Anything that wants out has to go through a proxy (and anything that wants in has to go through the reverse proxy or the bastion host). I may be a bit paranoid. > — [classichasclass on lobsters · 1 points, 1 comments](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem#c_gjljob) **Source threads** - [lobsters](https://lobste.rs/s/ugkhor/my_homelab_got_hacked_postmortem) · 42 points · 8 comments - [hackernews](https://news.ycombinator.com/item?id=49251087) · 7 points · 0 comments ## Similar posts on daily.dev - [Hackers now exploit critical Gitea flaw in code injection attacks](https://daily.dev/posts/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks-gmz4nkjzi) · BleepingComputer · 2 upvotes · 0 comments - [Over 8,300 Gitea servers vulnerable to code execution attacks](https://daily.dev/posts/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks-rbh2jcepp) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#self-hosting](https://daily.dev/tags/self-hosting), [#forgejo](https://daily.dev/tags/forgejo) [View this post on daily.dev](https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"My Homelab Got Hacked - A Postmortem","url":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw"},"datePublished":"2026-08-12T22:40:50.733Z","dateModified":"2026-08-13T10:41:35.170Z","description":"A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b1f1f0c25b7b4a64c506b7fc47280642?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b1f1f0c25b7b4a64c506b7fc47280642?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,docker,self-hosting,forgejo","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"My Homelab Got Hacked - A Postmortem"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/my-homelab-got-hacked---a-postmortem-dlhslsoqw#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-60004 and how does it affect Gitea and Forgejo?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-60004 is a remote code execution vulnerability in Gitea's diffpatch API endpoint, which Forgejo inherited since it is based on Gitea. An attacker can push a malicious repository containing a crafted Git hook, then trigger the diffpatch endpoint to execute the hook and gain code execution on the server. The bug was patched in Gitea and in Forgejo's latest v15 LTS and v16 releases. Track newly disclosed CVEs like this one on daily.dev before they hit an unpatched self-hosted instance."}},{"@type":"Question","name":"How can I tell if my Forgejo or Gitea server was exploited by the diffpatch RCE?","acceptedAnswer":{"@type":"Answer","text":"Check server logs for at least two POST requests to /api/v1/repos/USER/REPO/diffpatch, often preceded by a sign-up, repo creation, and branch check within a few seconds, indicating a scripted attack. Look for unexpected users with a single repo containing a README and a hooks folder with a post-index-change script that curls an external IP and executes a payload. Developers auditing self-hosted git servers can follow incident writeups like this one on daily.dev."}},{"@type":"Question","name":"Why was an old Forgejo container still vulnerable to a patched CVE?","acceptedAnswer":{"@type":"Answer","text":"The instance was pinned to Forgejo v13, which reached end-of-life in January 2026, roughly six months before the exploit occurred, because Forgejo does not publish a 'latest' image tag and updates require manually checking versioned tags. The CVE had already been fixed in v15 LTS and v16, so staying on the outdated, unsupported v13 left the server exposed. Keeping pinned container versions current is easier when you track EOL and security news for tools like Forgejo on daily.dev."}}]} ```