Vulnerabilities · 101 days ago
A default Gogs install gives an attacker the whole forge, not one repo. The standard check of “only trusted repo owners can rebase” misses that open registration and repo creation let a stranger create their own account, then reach server-side command execution through rebase merging.
Rapid7 has now published the technical details and mapped the bug to CVE-2026-20182. It affects Gogs 0.14.2 and 0.15.0+dev, with no patch at publication, and the server process can then read private repositories, steal passwords, API tokens, SSH keys, and 2FA secrets, and tamper with hosted code.
That makes every still-running default instance a cross-tenant exposure, not a single-project bug. The overdue KEV deadline turns a disclosed flaw into an immediate patch issue for internet-facing Gogs servers.
6 sources covering this story
No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out
Researcher reported the vuln in March. Maintainers haven't responded to his messages since
Gogs Zero-Day Exposes Servers to Remote Code Execution
The critical-severity issue, assigned a CVSS score of 9.4, is an argument injection flaw that can be exploited by authenticated attackers via pull requests with malicious branch names.
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
Gogs 9.4 CVSS flaw exploits git rebase injection on 1,141 exposed instances, enabling remote code execution.
Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.
Authenticated RCE via Argument Injection in Gogs (NOT FIXED)
Rapid7 researchers found that Gogs allows authenticated users to achieve RCE on the server by creating a pull request with a specially crafted branch name.
New Gogs zero-day flaw lets hackers get remote code execution
An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances.
Part of the PlainSec briefing for 2026-05-28