Git repositories face massive credential exposure and critical Gitea vulnerability

Security researchers and government agencies have identified significant vulnerabilities and exposures involving Git-based development environments.

An analysis by Intruder revealed that 28,000 publicly reachable .git repositories were exposed due to web server misconfigurations. These exposures contained sensitive data, including AWS access keys, Stripe API keys, OpenAI API keys, and internal employee disciplinary files. The researchers noted that repository history often preserves secrets in past commits even after they are deleted from the current version of a project.

Separately, a critical remote code execution (RCE) vulnerability in Gitea, tracked as CVE-2026-60004, is being actively exploited in the wild. Rated 9.8 on the CVSS scale, the flaw allows attackers with repository write access to execute arbitrary shell commands. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, instructing federal agencies to remediate affected systems. One reported exploitation involved the deployment of cryptocurrency-mining payloads.