Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
Summary: Rapid7 disclosed a critical vulnerability in the open-source self-hosted Git service Gogs, rated 9.4 on CVSS and initially without a CVE identifier, that lets any authenticated user achieve remote code execution by creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the 'Rebase before merging' operation. The flaw requires no admin privileges or interaction with other users, remained unpatched as of writing after being reported to the maintainer on March 17, 2026, and was later patched in Gogs version 0.14.3 released on June 7, 2026, tracked as CVE-2026-52806 with a CVSS score of 9.9.
Why it matters: Rapid7 built a Metasploit module automating the full exploit chain against Linux and Windows targets, and by late June 2026 Wiz reported the flaw exploited in a cryptojacking campaign that used stolen Kubernetes service account tokens to spread laterally across more than 300 additional nodes.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-52806
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026