SecurityIndependently confirmed2 publishers2 min readPublished Updated
CVE-2026-52806 turns a Gogs branch name into command execution as the git user
Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.
The Watch · Security desk
What happened
- Rapid7 Labs disclosed CVE-2026-52806, a CWE-88 argument injection scored CVSSv3.1 9.9, which lets any authenticated Gogs user run commands as the server process user through a crafted pull request.
- Gogs defaults do the reachability work: open registration and no repository creation limit mean a stranger can sign up, own a fresh repository, and enable rebase merging without touching another account.
- Confirmed affected are Gogs 0.14.2 and the 0.15.0+dev branch at commit b53d3162, with earlier releases that support the rebase merge style rated likely vulnerable as well.
- The Gogs maintainer accepted Rapid7's patch and released 0.14.3 on June 7, 2026, with the identifier issued through GHSA-qf6p-p7ww-cwr9.
- Rapid7's Shodan query for visible Gogs sign-in pages returned 1,141 internet-facing instances at the time of publication.
Why it matters
- exposure One account on a shared instance reaches every other tenant's private repositories plus the database of password hashes, API tokens, SSH keys and 2FA secrets, so the incident scope is every user on the box rather than the attacker's own project.
- constraint Because filesystem-level writes bypass Gogs' audit logging, the instance's own records will not evidence repository tampering, and integrity verification has to be done against Git objects from outside the application.
- contradiction runZero's asset-hunting guidance still reports no CVE and no vendor patch while Rapid7 names both, so a team triaging from the inventory page will stop at configuration hardening and never schedule the upgrade.
- precedent A default configuration that hands an unauthenticated visitor the privileges the exploit needs argues for treating self-hosted Git under the patch SLA of a public web application, not an internal tool.
Four actions, all inside the attacker's own account: sign up, create a repository, flip one setting in it, open a pull request [19]. The flaw sits in the last step. According to runZero, Gogs hands the pull request's source branch name straight to `git rebase` without a `--` delimiter to mark the end of options [3], so a branch name beginning with --exec is parsed as a flag and its value runs as a command during the rebase merge [2].
Version 0.14.2 is the awkward part. runZero's own timeline lists 0.14.2 as the fix for CVE-2026-25921, the March 2026 cross-repository LFS overwrite scored 9.3 and reachable without authentication [14]. Rapid7 lists 0.14.2 as confirmed vulnerable to 52806. Anyone who upgraded in March to clear the LFS bug is sitting on the June one, and 0.14.3 is the first build that satisfies both [17].
Execution lands as the Gogs process user, which on Docker installs is git at UID 1000 and on binary installs is whatever account the administrator chose [16]. Every repository on the instance then sits under one REPOSITORY_ROOT with no OS-level isolation between them [7]. That is the same shape as the LFS flaw, where all objects shared a single location without per-repository separation [14]; in both cases one tenant gets leverage over another tenant's data because nothing separates them on disk [20].
This is the third separately tracked Gogs flaw in the seven months from December 2025 to June 2026 [18]. The first, CVE-2025-8110, was an authenticated arbitrary file overwrite scored 7.8 in versions 0.13.3 and earlier, and runZero notes evidence of exploitation in the wild for it [15]. That is the closest thing available to a base rate for attacker interest in this software.
The 1,141 figure is a floor. It counts hosts whose Gogs sign-in title is visible to Shodan, and Rapid7 says the real install base is much larger because most instances sit behind VPNs or on internal networks [8]; a project carrying roughly 50,000 GitHub stars and 5,000 forks is not deployed 1,141 times [11][21]. For instances that cannot restart on 0.14.3 quickly, runZero's configuration advice still applies: DISABLE_REGISTRATION = true, MAX_CREATION_LIMIT = 0, and no internet path to the web interface [13]. Rapid7's own triage line is the account count. Any Gogs instance with more than one user is effectively multi-tenant, and on those, a single member holds everything the git user can read [10].
What to watch
- Whether exploitation of CVE-2026-52806 is observed in the wild, as runZero recorded for CVE-2025-8110.
- Whether inventory vendors update their Gogs entries to name the CVE and 0.14.3 as the fix.
- Whether the Shodan sign-in count moves after June 7, the only public read on 0.14.3 adoption.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence86
- Adoption50
- Hype gap+8
- Incentives72
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Rapid7 Labs discovered CVE-2026-52806, an argument injection (CWE-88) flaw in Gogs scored CVSSv3.1 9.9 (Critical), allowing any authenticated user to achieve remote code execution on the server via a pull request; the exploit requires no admin privileges and no interaction with other users.
- [2]
The malicious branch name injects the --exec flag into git rebase during the "Rebase before merging" merge operation, producing arbitrary command execution as the Gogs server process user.
- [3]
runZero describes the cause as a malicious pull request branch name passed directly to the git rebase command without a -- delimiter to indicate the end of options, so the branch name is interpreted as the --exec flag.
- [4]
Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false) and no limit on repository creation (MAX_CREATION_LIMIT = -1); any registered user who creates a repo is automatically its owner, enabling rebase merging is a single toggle in settings, and the entire chain can be operated without interaction from any other user.
- [5]
On June 7, 2026, the Gogs maintainer accepted Rapid7's patch and released version 0.14.3, which fixes the vulnerability; the CVE was assigned via GHSA-qf6p-p7ww-cwr9.
- [6]
Gogs 0.14.2 and 0.15.0+dev (commit b53d3162) were confirmed affected, and all prior versions supporting the "Rebase before merging" style are likely vulnerable as well.
- [7]
The Gogs process user has direct filesystem-level read/write access to every repository under a single REPOSITORY_ROOT directory with no OS-level isolation between repositories, and direct filesystem manipulation bypasses Gogs' audit logging.
- [8]
A Shodan search for http.title:"Gogs" http.title:"Sign In" returned 1,141 internet-facing instances at the time of publication; Rapid7 says the real install base is much larger because most deployments sit behind VPNs or internal networks.
- [9]
Successful exploitation lets the attacker read every repository on the instance including other users' private repos, dump the database containing password hashes, API tokens, SSH keys and 2FA secrets for all users, pivot to network-reachable systems, and modify any hosted repository's code.
- [10]
Rapid7 states that any Gogs instance with more than one user account is effectively multi-tenant, the default for organizations, universities and teams, and that on such instances the flaw gives a single authenticated user full control of the underlying server.
- [11]
Gogs has roughly 50,000 GitHub stars and over 5,000 forks and is commonly deployed by companies, universities and open-source projects.
- [12]
The vulnerability was discovered by Jonah Burgess (CryptoCat), Senior Security Researcher at Rapid7.
- [13]
runZero's write-up states the vulnerability does not currently have a CVE ID assigned and the vendor has not released a patch, and recommends disabling open registration (DISABLE_REGISTRATION = true), limiting internet exposure, and restricting repository creation (MAX_CREATION_LIMIT = 0).
- [14]
In March 2026, Gogs disclosed CVE-2026-25921, a cross-repository Git LFS object overwrite caused by missing content hash verification, rated critical at CVSS 9.3 and exploitable by a remote unauthenticated adversary in versions prior to 0.14.2; Gogs stores all LFS objects in a single location without repository isolation, and the fix is upgrading to 0.14.2 or later.
- [15]
In December 2025, Wiz reported CVE-2025-8110, a Gogs 0-day allowing remote authenticated attackers to overwrite arbitrary files and execute code with the privileges of the Gogs server process, scored CVSS 7.8 in versions 0.13.3 and prior, with evidence that it is being actively exploited in the wild.
- [16]
The vulnerability affects all supported platforms (Linux, macOS, Windows) and all installation methods; on Docker installations the Gogs process runs as the git user (UID 1000 by default), and on binary installations the process user depends on how the administrator deployed the service.
- [17]
Gogs 0.14.2 is simultaneously the fix version for CVE-2026-25921 and a confirmed-vulnerable version for CVE-2026-52806, so 0.14.3 is the earliest release that clears both.
- [18]
Three separately tracked Gogs vulnerabilities were disclosed across the seven months from December 2025 to June 2026.
- [19]
On a default install the chain is four attacker actions inside a single self-owned account: register, create a repository, enable rebase merging, open a pull request with a crafted branch name.
- [20]
CVE-2026-52806 and CVE-2026-25921 both let one tenant reach another tenant's data because Gogs keeps shared assets in one location with no per-repository separation on disk.
- [21]
The 1,141 Shodan result is a lower bound on internet-exposed Gogs instances, since the query only matches hosts presenting a visible Gogs sign-in title and Rapid7 says most deployments are internal.
Sources
2 independent publishers whose own reporting we read for this story.
- Authenticated RCE via Argument Injection in Gogs (NOT FIXED)
rapid7.com
2 articles · August 27, 2026
- Gogs RCE vulnerability: How to find impacted assets
runzero.com
1 article · August 27, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.