Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let’s dive in!
As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I’m implementing myself:
- Miner detection. I’ve updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I’m doing simple up / down monitoring. Fixed.
- Access logging. I turned on access logging for my homelab Caddy instances.
- Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
- Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that’s next.
- Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
- Built a tool.
log-inventory.sh, so “could I actually reconstruct what happened” is a command I run instead of a thing I assume.
I don’t think I will ever be convinced to leave anything on my home network open to the internet no matter how convenient it is.
I gave up , don’t have the time to maintain it anymore. Changed DNS to make my domain point to local lan IP so everything still works but only at home.
I wonder if the person who downvoted you thought you pointed your public DNS record to a 192.168 network, instead of making a change to your local DNS server like I’m assuming you did.
Meanwhile my entire “homelab” except for HA is hosted on a VPS
Yeah same. I am really bad at keeping stuff updated so I rather keep it local too.
Not updating stuff + Public sign ups enabled (did you even read the setup guide?) + Unrestricted internet access
Yeah I wonder what could possibly go wrong…
But great writeup
At least he got to learn from it. Never waste a good disaster.
And sharing it with peeps who haven’t encountered these vulnerabilities yet. We are all trying to improve and reading this is better than doomscrolling.
Also let’s be honest, it was entertaining.
Adventure is when trouble happened to somebody else! :p
I should really do a security checkup on my setup…
Have you thought about log aggregation with something like Prometheus/graphana or ELK?
Lol thinking about cpu notifications for myself. I get notified when the fans ramp up on my server.
Also feed it to wazuh
And detected mostly because the automated script kiddie set up a cryptominer to generate $0.0001
There are way more valuable and destructive ways once you have RCE like:
- Searching for committed API keys “anyway my repo is private”
- Ransomware in case there were no backups
Nice write up, also glad to see someone using bear blog in the field! Adding your blog to my RSS reader!
I just recently went through a much more benign, but scary nonetheless version of this.
I realized that my Ansible directory, that I had made public on GitHub to share as an example to some folks, had secrets committed and pushed.
It was the direct URL and credentials of an app I developed to store non-PII customer data. Now, it wouldn’t be the end of the world if someone noticed this and scraped the data, but it wouldn’t be good, either.
Luckily, I have Caddy access logs, and it appears no one ever accessed it.
So I pulled the secrets out of the Ansible directory and made the repo private, I rotated the credentials, and installed Crowdsec to monitor Caddy access logs and ban bad actors.
I only noticed the secrets because I had just setup Authelia as an OAuth2 provider for my homelab, and I was adding it to my backup scripts.
Ayy, just went through the same troubles with Authelia earlier this week.
Only 4 services I could conmect ao far but still neat to have :)
I’m thinking of adding Falco to my homelab.
Thanks for posting that. I hadn’t heard of falco before. Cncf graduated, open source, cloud native. I’m going to give this a shot.
My server got hacked once and was mining crypto! I noticed it when I heard the fans were at 100% when walking passed the room lol. Turns out, qbittorrent-nox used UPNP for its web admin endpoint enabled by default and qbittorrent can do many things like run custom scripts. My mistake was not changing its login credentials. Exposed my full system. Live and learn.
Thanks for this! I didn’t understand any of it, but I hope to eventually.
About the only recent even I’ve had was when I was sitting at my desk reading an article. I noticed the mouse slightly move, but I hand no hand on the mouse. I sit there watching it, not manually moving the mouse or typing on the keyboard. It really freaked me out. Turns out, my old desk pad had a slight curl towards the edge the mouse was at, and the curl would make the mouse sense movement ever so slightly. I deployed a new desk pad, and things are back to normal. Whew!
What version of forgejo were you using? CVE-2026-60004 references gitea 1.27.1
Unfortunately, Forgejo only offers versioned image tags, meaning no latest tag. I still had mine pinned to v13 which reached EOL 6 months ago in January, 2026.
I hate providers not offering me a latest tag. Is there any valid reason not to do that?
Even worse, super stupid version tags such as MinIO is using:
RELEASE.2025-09-07T16-13-09Z-cpuv1(I wish I made that up)My guess, auto updates for major versions is not good practice. Installations potentially corrupt and users come screaming to the project maintainers instead of searching the blame by themselfe.
forgejo defined the lifecycle for every version so just add a calendar entry for when the supports runs out and then update the 3 characters in the docker compose file.
I can get that and I also prefer sticking to major versions. However, I am chaotic and easily have 50 different docker images, checking all the release cycle of all of those gets exhausting.
I believe I need to start generating notifications if a tag has not received an update for more than 30d.
Good write up! Since you’re using Komodo already, are your compose stacks in git? Because if they are, check the renovate bot. It will read your files with their pinned image tags, check upstream for newer tags, and creates MRs (can also be set to auto merge) to update. Can be configured per stack.
What’s komodo? I’m thinking of starting a home server so learning how to harden/automate updates (which is what it sounds like you’re saying) is what I want to learn.
It’s a tool to manage docker stacks, e.g. by reading them from git repos. You can configure your git forge in a way to ping Komodo when something in a repo changed, Komodo then deploys the new version. You’d need your own git forge, e.g. forgejo. This is a good guide:
You can start without Renovate to get going, but you’ll want it sooner or later to automate checks for updates.
OIDC and zero signups for everything. I’ve been very happy with Pomerium (ZTNA) + Keycloak for all my public facing apps, although the free version doesn’t have any client signals which I was hoping for when I starteed.
My project this week is integrating the app logging I have into Crowdsec and start having Crowdsec do more analysis.
