Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Acronis Threat Research Unit reports active in-the-wild exploitation of Gitea RCE CVE-2026-60004 (CVSS 9.8, versions 1.17-1.27.0, fixed in 1.27.1) by a Chinese-speaking actor dubbed Red Heron. The actor scanned 1,386 Gitea servers across seven countries, held a separate list of 477 Taiwan-based targets, and confirmed victims in Canada, Argentina, Taiwan, the US, and Sri Lanka. Intrusions deployed the JITTERLY Linux implant with the SIXZUT LD_PRELOAD rootkit, stole password hashes and SSH keys, and in one case gained root admin access to a three-node Proxmox cluster.
- CVE-2026-60004 (CVSS 9.8) actively exploited; Gitea fixed in 1.27.1 released July 27, 2026
- Red Heron automated account registration, exploitation, repo theft, and log cleanup
- JITTERLY implant bundles SIXZUT LD_PRELOAD rootkit hiding files, processes, connections
- Victims span Canada, Argentina, Taiwan, US, Sri Lanka including energy and government sectors
- All secrets on compromised Gitea servers (tokens, SSH keys, source) should be rotated
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days. Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner. | 9.8 | 87% | KEV PoC ×4 |
| moderate≈8,300+ internet-exposed Gitea servers (public scan count) |
Full article617 words · extracted from cybersecuritynews.com · click to collapse
Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers.
Researchers found that a Chinese-speaking threat actor, named Red Heron, quickly turned public exploit code into an automated attack framework that stole source code, collected credentials, installed backdoors, and moved deeper into victim networks.
The flaw affects Gitea versions 1.17 through 1.27.0 and has a CVSS severity score of 9.8. Gitea fixed the issue in version 1.27.1, released on July 27, 2026. The vulnerability exists in Gitea’s diffpatch feature, which processes repository patches using Git commands.
The exploit abuses Git’s three-way merge behavior to write a malicious file into the repository hook directory. When Git later performs an index-related action, the malicious hook executes commands with the permissions of the Gitea service account. This gives attackers remote code execution on the vulnerable server.
Hackers Exploiting Gitea n-day RCE Vulnerability
Although exploitation requires write access to a repository, many exposed Gitea deployments allow users to register new accounts. Attackers can abuse this setting by creating an account, opening a repository, submitting a crafted patch, and triggering the flaw without needing stolen credentials.
Acronis Threat Research Unit discovered that Red Heron scanned 1,386 Gitea servers across seven countries shortly after the public proof-of-concept became available. The group also maintained a separate list of 477 Taiwan-based targets.
Its records categorized organizations using Simplified Chinese labels for sectors including defense, elections, energy, aerospace, telecommunications, government, research, cloud services, and developer tooling.
Researchers identified confirmed victim activity in Canada, Argentina, Taiwan, the United States, and Sri Lanka. The attackers used automated tools to register accounts, exploit targets, download repositories, and remove selected traces from Gitea databases.
In several cases, the attackers stole database files containing password hashes and configuration data that could expose application secrets, internal tokens, and SSH keys.
One compromised renewable-energy organization in Canada suffered extensive intrusion activity. The attackers reportedly accessed source code, internal applications, HR and CRM systems, authentication services, business APIs, and Docker network information. They also planted SSH keys for persistent access and collected configuration secrets from the environment.
The campaign also targeted a Taiwanese environment hosted on a Synology NAS. From the initial Gitea compromise, Red Heron obtained a Proxmox root authentication ticket and gained administrative access to a three-node Proxmox cluster.
The attackers uploaded payloads to multiple nodes and initiated virtual-machine backup operations, which could have enabled the theft of complete VM disk images rather than only source repositories.
Researchers also linked the activity to a Linux implant named JITTERLY. The malware supports command execution, file uploads and downloads, network tunneling, interactive terminal sessions, port scanning, reverse port forwarding, and internal network pivoting.
JITTERLY communicates with its command-and-control server over raw TCP using encrypted messages. JITTERLY contains an embedded LD_PRELOAD rootkit called SIXZUT.
The rootkit can hide malicious files, processes, and network connections from common Linux monitoring tools. It can also block attempts to terminate the implant and relaunch it when it is removed or stopped.
Organizations running self-hosted Gitea should upgrade to version 1.27.1 or later immediately. Administrators should turn off open registration when it is not required, restrict access to internet-facing Gitea instances, review newly created accounts and repositories, and investigate unexpected requests to diffpatch endpoints.
Treat any secrets stored on a compromised Gitea server, including tokens, passwords, SSH keys, and source code, as exposed and rotate them.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/hackers-exploiting-gitea-n-day-rce-vulnerability/