Gitea RCE Vulnerability Actively Exploited by Red Heron Threat Actor
A critical remote code execution vulnerability in Gitea, CVE-2026-60004, is being actively exploited by the Chinese-speaking threat actor Red Heron to compromise source-code management servers.
Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers. Researchers discovered that a Chinese-speaking threat actor, identified as Red Heron, rapidly weaponized public exploit code into an automated attack framework. This framework has been used to steal source code, harvest credentials, install backdoors, and facilitate deeper network penetration.
The vulnerability affects Gitea versions 1.17 through 1.27.0 and carries a severe CVSS score of 9.8. Gitea addressed the flaw by releasing version 1.27.1 on July 27, 2026. The exploit leverages a weakness in Gitea's diffpatch feature, which processes repository patches using Git commands. Attackers abuse Git's three-way merge functionality to inject a malicious file into the repository's hook directory. When Git subsequently performs an index-related operation, the malicious hook executes commands with the privileges of the Gitea service account, thereby achieving remote code execution on the compromised server.
While exploitation technically requires write access to a repository, many exposed Gitea instances permit new user account registrations. Attackers can exploit this by creating an account, initiating a repository, submitting a specially crafted patch, and triggering the vulnerability without needing pre-existing credentials. This ease of access has contributed to the rapid spread of exploitation.
Acronis Threat Research Unit observed Red Heron actively scanning 1,386 Gitea servers across seven countries shortly after the proof-of-concept exploit became publicly available. The group also maintained a distinct list of 477 targets located in Taiwan. Their reconnaissance efforts categorized organizations by sector, including defense, elections, energy, aerospace, telecommunications, government, research, cloud services, and developer tooling, often using Simplified Chinese labels.
Confirmed victim activity was identified in Canada, Argentina, Taiwan, the United States, and Sri Lanka. The attackers employed automated tools to register accounts, exploit vulnerable servers, exfiltrate repositories, and systematically erase traces from Gitea databases. In several instances, attackers successfully stole database files containing sensitive information such as password hashes and configuration data, potentially exposing application secrets, internal tokens, and SSH keys.
One notable compromise involved a Canadian renewable energy organization, which experienced extensive intrusion. The attackers gained access to source code, internal applications, HR and CRM systems, authentication services, business APIs, and Docker network configurations. They also established persistent access by planting SSH keys and harvested configuration secrets from the environment. The campaign also targeted a Taiwanese environment hosted on a Synology NAS, where attackers leveraged the initial Gitea compromise to obtain a Proxmox root authentication ticket, granting them administrative control over a three-node Proxmox cluster.
Further analysis revealed the attackers' use of a Linux implant named JITTERLY, which supports a wide array of malicious functionalities including command execution, file transfer, network tunneling, interactive terminal sessions, port scanning, and internal network pivoting. JITTERLY communicates with its command-and-control server using encrypted TCP messages and incorporates an embedded LD_PRELOAD rootkit called SIXZUT. This rootkit is designed to conceal malicious files, processes, and network connections from standard Linux monitoring tools, and it actively prevents attempts to terminate the implant, relaunching itself if stopped or removed.
Organizations operating self-hosted Gitea instances are strongly advised to upgrade to version 1.27.1 or a later release immediately. Security best practices include disabling open registration if not essential, restricting access to internet-facing Gitea deployments, diligently reviewing newly created accounts and repositories, and investigating any unusual requests directed at diffpatch endpoints. Any secrets, including tokens, passwords, SSH keys, or source code, stored on a potentially compromised Gitea server should be treated as exposed and promptly rotated.