Critical Gitea RCE Vulnerability Exploited by Red Heron Threat Actor
Hackers are actively exploiting CVE-2026-60004, a critical remote code execution (RCE) vulnerability in Gitea, to compromise internet-facing source-code management servers. The flaw, affecting Gitea versions 1.17 through 1.27.0, carries a CVSS score of 9.8 and was patched in version 1.27.1, released on July 27, 2026.
The vulnerability resides in Gitea’s diffpatch feature, which processes repository patches using Git commands. Attackers abuse Git’s three-way merge behavior to write malicious files into the repository hook directory, enabling RCE with the permissions of the Gitea service account. Exploitation requires write access, but many exposed Gitea instances allow open user registration, allowing attackers to create accounts, submit crafted patches, and trigger the flaw without credentials.
A Chinese-speaking threat actor, Red Heron, rapidly weaponized public exploit code into an automated attack framework. The group scanned 1,386 Gitea servers across seven countries, with a separate target list of 477 Taiwan-based organizations in sectors including defense, energy, aerospace, telecommunications, government, and cloud services.
Confirmed victim activity has been observed in Canada, Argentina, Taiwan, the U.S., and Sri Lanka. Red Heron’s automated tools register accounts, exploit targets, download repositories, and erase traces from Gitea databases. In some cases, attackers stole password hashes, configuration data, and application secrets, including SSH keys and internal tokens.
One compromised Canadian renewable-energy organization faced extensive intrusion, with attackers accessing source code, HR/CRM systems, authentication services, and Docker network data. They also planted SSH keys for persistence and extracted environment secrets. In another incident, a Taiwanese Synology NAS-hosted Gitea server was breached, leading to the theft of a Proxmox root authentication ticket and administrative access to a three-node Proxmox cluster. Attackers initiated VM backup operations, potentially enabling the exfiltration of complete disk images.
Red Heron’s campaign is linked to JITTERLY, a Linux implant with capabilities including command execution, file transfer, network tunneling, and port scanning. The malware communicates over encrypted TCP and embeds SIXZUT, an LD_PRELOAD rootkit that hides malicious files, processes, and connections while resisting termination.
Source: https://cybersecuritynews.com/hackers-exploiting-gitea-n-day-rce-vulnerability/
Triskele Labs cybersecurity rating report: https://www.rankiteo.com/company/triskele-labs
"id": "TRI1789467885",
"linkid": "triskele-labs",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Renewable Energy',
'location': 'Canada',
'name': 'Canadian renewable-energy organization',
'type': 'Organization'},
{'industry': 'Technology/Cloud Services',
'location': 'Taiwan',
'name': 'Taiwanese Synology NAS-hosted Gitea server',
'type': 'Organization'},
{'industry': ['Defense',
'Energy',
'Aerospace',
'Telecommunications',
'Government',
'Cloud Services'],
'location': 'Taiwan',
'type': 'Organization'}],
'attack_vector': 'Exploitation of CVE-2026-60004 via crafted patches in '
'Gitea’s diffpatch feature',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': ['Git repositories',
'Configuration files',
'SSH keys',
'Authentication tokens',
'VM disk images'],
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (authentication secrets, '
'personally identifiable information, '
'proprietary source code)',
'type_of_data_compromised': ['Source code',
'Password hashes',
'Configuration data',
'Application secrets (SSH keys, '
'internal tokens)',
'HR/CRM data',
'Docker network data',
'Proxmox authentication tickets',
'VM disk images']},
'date_publicly_disclosed': '2026-07-27',
'description': 'Hackers are actively exploiting CVE-2026-60004, a critical '
'remote code execution (RCE) vulnerability in Gitea, to '
'compromise internet-facing source-code management servers. '
'The flaw affects Gitea versions 1.17 through 1.27.0 and was '
'patched in version 1.27.1. The vulnerability resides in '
'Gitea’s diffpatch feature, allowing attackers to write '
'malicious files into the repository hook directory, enabling '
'RCE. The Chinese-speaking threat actor Red Heron weaponized '
'the exploit into an automated attack framework, targeting '
'organizations across multiple sectors and countries.',
'impact': {'data_compromised': 'Source code, password hashes, configuration '
'data, application secrets (SSH keys, internal '
'tokens), HR/CRM systems data, Docker network '
'data, Proxmox root authentication tickets, VM '
'disk images',
'identity_theft_risk': 'High (personally identifiable information '
'and authentication secrets compromised)',
'operational_impact': 'Unauthorized access to critical systems, '
'potential exfiltration of sensitive data, '
'persistence via SSH keys',
'systems_affected': 'Gitea servers, Proxmox clusters, HR/CRM '
'systems, authentication services, Docker '
'networks'},
'initial_access_broker': {'backdoors_established': 'SSH keys for persistence',
'entry_point': 'Exploitation of CVE-2026-60004 via '
'Gitea’s diffpatch feature',
'high_value_targets': ['Defense',
'Energy',
'Aerospace',
'Telecommunications',
'Government',
'Cloud Services']},
'post_incident_analysis': {'corrective_actions': 'Patch management, disabling '
'open registration, enhanced '
'monitoring, network '
'segmentation',
'root_causes': 'Unpatched Gitea servers, open user '
'registration, lack of monitoring '
'for malicious repository hooks'},
'recommendations': 'Patch Gitea to version 1.27.1 or later, disable open user '
'registration, monitor for unauthorized account creation, '
'review repository hooks for malicious activity, and '
'implement network segmentation for critical systems.',
'threat_actor': 'Red Heron',
'title': 'Critical Gitea RCE Vulnerability Exploited by Red Heron Threat '
'Actor',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-60004'}