Critical Gitea RCE Vulnerability Under Active Exploitation

Key Takeaways

• A critical remote code execution (RCE) vulnerability in Gitea (CVE-2026-60004) is under active exploitation.
• The flaw, rated 9.8 CVSS, affects Gitea versions 1.17 through 1.27.0.
• A Chinese-speaking threat group, “Red Heron,” is leveraging the vulnerability to steal source code, credentials, and deploy backdoors, including a new Linux rootkit.
• Gitea released a fix in version 1.27.1 on July 27, 2026.

Critical Gitea RCE Under Active Exploitation

Cybersecurity researchers have detected active exploitation of a severe remote code execution vulnerability, identified as CVE-2026-60004, in Gitea, a popular open-source self-hosted Git service. Threat actors are targeting internet-accessible Gitea servers to gain unauthorized access and compromise source-code management systems.

The vulnerability impacts Gitea versions ranging from 1.17 up to, and including, 1.27.0, carrying a critical CVSS score of 9.8. Gitea addressed this flaw with the release of version 1.27.1 on July 27, 2026. The root cause lies within Gitea’s diffpatch feature, which is responsible for processing repository patches through Git commands.

Exploitation Details and Threat Actor Activity

The exploitation technique manipulates Git’s three-way merge functionality to inject a malicious file into a repository’s hook directory. Subsequently, when Git executes an index-related action, this malicious hook is triggered, running commands with the privileges of the Gitea service account. This grants attackers remote code execution capabilities on the vulnerable server.

Although successful exploitation typically requires write access to a repository, many exposed Gitea installations permit new user registrations. This configuration allows attackers to create an account, establish a repository, submit a specially crafted patch, and activate the vulnerability without needing pre-existing stolen credentials.

Acronis Threat Research Unit discovered that a Chinese-speaking threat group, dubbed “Red Heron,” rapidly operationalized publicly available exploit code. This group developed an automated attack framework to conduct reconnaissance and exploitation. Shortly after the public proof-of-concept emerged, Red Heron scanned 1,386 Gitea servers across seven different countries. The group also maintained a distinct list of 477 targets specifically located in Taiwan.

Red Heron categorized target organizations using Simplified Chinese labels, indicating interest in sectors such as defense, elections, energy, aerospace, telecommunications, government, research, cloud services, and developer tooling.

Campaign Impact and Malware Deployment

Confirmed victim activity has been identified in Canada, Argentina, Taiwan, the United States, and Sri Lanka. The attackers utilized automated tools to register accounts, exploit targets, exfiltrate repositories, and selectively erase forensic traces from Gitea databases. In numerous instances, database files containing password hashes and configuration data, potentially exposing application secrets, internal tokens, and SSH keys, were stolen.

One notable compromise involved a renewable-energy organization in Canada, which experienced a broad intrusion. Reports indicate the attackers gained access to source code, internal applications, HR and CRM systems, authentication services, business APIs, and Docker network information. They also deployed SSH keys for persistent access and extracted configuration secrets from the environment.

Another incident involved a Taiwanese environment hosted on a Synology NAS. Following the initial Gitea breach, Red Heron managed to obtain a Proxmox root authentication ticket, achieving administrative control over a three-node Proxmox cluster. The attackers uploaded payloads to multiple nodes and initiated virtual machine backup operations, suggesting an intent to steal complete VM disk images rather than just source repositories.

Researchers have also linked this campaign to a Linux implant named JITTERLY. This sophisticated malware offers extensive capabilities, including command execution, file uploads and downloads, network tunneling, interactive terminal sessions, port scanning, reverse port forwarding, and internal network pivoting. JITTERLY communicates with its command-and-control server via raw TCP using encrypted messages. The implant also incorporates an embedded LD_PRELOAD rootkit, known as SIXZUT.

SIXZUT is designed to conceal malicious files, processes, and network connections from standard Linux monitoring tools. It can also thwart attempts to terminate the implant and will relaunch itself if removed or stopped, ensuring persistence.

What You Should Do

• Upgrade Immediately: Organizations running self-hosted Gitea instances must upgrade to version 1.27.1 or later without delay to patch CVE-2026-60004.
• Disable Open Registration: If not strictly necessary, disable open user registration on all Gitea instances to prevent unauthorized account creation.
• Restrict Access: Limit public access to internet-facing Gitea instances where possible, using firewalls or VPNs.
• Monitor for Suspicious Activity: Regularly review newly created accounts and repositories. Investigate any unexpected requests to diffpatch endpoints.
• Rotate Secrets: Assume any secrets stored on a compromised Gitea server (including tokens, passwords, SSH keys, and source code) are exposed and rotate them immediately.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.