{"id":1740,"date":"2026-09-17T16:10:28","date_gmt":"2026-09-17T10:40:28","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1740"},"modified":"2026-09-21T12:47:14","modified_gmt":"2026-09-21T07:17:14","slug":"red-heron-gitea-rce","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/red-heron-gitea-rce\/","title":{"rendered":"Red Heron Gitea RCE: How CVE-2026-60004 Led to Linux Compromise"},"content":{"rendered":"

The Red Heron Gitea RCE campaign exploited CVE-2026-60004, a critical remote code execution vulnerability affecting Gitea versions 1.17 through 1.27.0, to compromise internet-facing Gitea servers.<\/p>\n

A threat actor tracked as Red Heron exploited the Gitea RCE vulnerability CVE-2026-60004 against internet-facing Gitea servers. The campaign progressed beyond initial server compromise into source-code theft, credential collection, persistence, and lateral movement. Acronis Threat Research Unit linked the activity to a Chinese-speaking threat cluster.<\/p>\n

CVE-2026-60004 affects Gitea 1.17 through versions before 1.27.1. The vulnerability abuses Gitea’s diffpatch<\/code> API to install and execute a Git hook from repository-controlled content. Gitea patched the issue in version 1.27.1.<\/p>\n

The campaign matters because Gitea can sit close to source code, deployment infrastructure, application secrets, and other internal systems. In this case, Red Heron reportedly turned access to exposed Gitea servers into a broader Linux infrastructure compromise.<\/p>\n

Red Heron Gitea RCE campaign at a glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span><\/b>\u00a0<\/span><\/td>\nCVE-2026-60004<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected product<\/span><\/b>\u00a0<\/span><\/td>\nGitea<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability<\/span><\/b>\u00a0<\/span><\/td>\nRemote code execution through\u00a0diffpatch<\/code>\u00a0Git hook installation<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected versions<\/span><\/b>\u00a0<\/span><\/td>\n>= 1.17 and < 1.27.1<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Patched version<\/span><\/b>\u00a0<\/span><\/td>\n1.27.1<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span><\/b>\u00a0<\/span><\/td>\n9.8, CVSS v3.1<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CWE<\/span><\/b>\u00a0<\/span><\/td>\nCWE-94: Improper Control of Generation of Code<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Execution context<\/span><\/b>\u00a0<\/span><\/td>\nGitea OS\/service account<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation<\/span><\/b>\u00a0<\/span><\/td>\nConfirmed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA KEV<\/span><\/b>\u00a0<\/span><\/td>\nAdded August 25, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Campaign<\/span><\/b>\u00a0<\/span><\/td>\nRed Heron<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The CVE record gives CVE-2026-60004 a CVSS v3.1 score of 9.8 and identifies versions 1.17 through versions before 1.27.1 as affected. CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) Catalog on August 25, 2026.<\/p>\n

How CVE-2026-60004 Turns a Gitea Patch Into a Git Hook<\/h2>\n

The defining mechanism behind CVE-2026-60004<\/a> sits inside Gitea’s diffpatch<\/code> functionality.<\/p>\n

Gitea processes attacker-controlled patches inside a temporary bare Git clone. With Git 2.32 or later, submitting the same crafted patch twice can create an add\/add collision. Git’s three-way fallback can then write an executable post-index-change<\/code> file into the bare repository’s hooks<\/code> directory.<\/p>\n

Because the repository root of a bare clone is also $GIT_DIR<\/code>, that file becomes a live Git hook. Git invokes the hook during the index operation, causing attacker-controlled commands to execute as the Gitea service account.<\/p>\n

The exploit trigger requires Git 2.32 or newer, an enabled diffpatch<\/code> route, and a writable and executable temporary filesystem. The attacker also needs ordinary repository write access. With open registration enabled, an unauthenticated visitor can obtain that access by registering an account and creating a repository.<\/p>\n

Open registration is not inherently required for exploitation. Instead, it provides one path through which an unauthenticated visitor can obtain the required repository write access.<\/p>\n

This distinction matters. CVE-2026-60004 is fundamentally a repository-write-to-server-code-execution vulnerability. Open registration can create a path to that prerequisite on exposed deployments.<\/p>\n

How the Red Heron Gitea RCE Expanded Into Linux Infrastructure<\/h2>\n

Acronis Threat Research Unit said Red Heron rapidly weaponized CVE-2026-60004 against internet-facing Gitea instances. The operation progressed from source-code theft into persistent access, credential collection, and lateral movement.<\/p>\n

Reporting on the Acronis investigation says the actor scanned 1,386 Gitea instances across seven countries, while maintaining another dataset containing 477 Taiwan-based systems. Researchers confirmed compromises at 13 organizations across Canada, Argentina, Taiwan, the United States, Qatar, and Sri Lanka.<\/p>\n

Targets spanned sectors including defense, energy, aerospace, telecommunications, government, public safety, elections, and research.<\/p>\n

The campaign eventually reached infrastructure beyond the original Gitea servers. Acronis reported lateral movement and deeper infrastructure access, showing why a compromised development platform should not be treated as an isolated web-server incident.<\/p>\n

JITTERLY and SIXZUT Added Persistence and Concealment<\/h2>\n

Analysis of infrastructure associated with Red Heron revealed a C++ Linux implant called JITTERLY.<\/p>\n

JITTERLY provides more than 30 post-exploitation commands covering capabilities such as:<\/p>\n