CVE-2026-52806, Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch)
Defender actions
- Upgrade self-hosted Gogs to 0.14.3 (CVE-2026-52806) and disable open self-registration (
DISABLE_REGISTRATION = true) on internet-exposed instances. - Upgrade self-hosted Gogs to 0.14.3 now if not already done, exploitation status changed. CVE-2026-52806 is now actively exploited (§ 4); disable open self-registration (
DISABLE_REGISTRATION = true) on any internet-exposed instance and hunt forgit rebase/--execchild processes under the Gogs service user. Common in EU research, university and smaller public-sector Git hosting.
Analysis
BSI advisory WID-SEC-2026-2013 (rated kritisch, 2026-06-19) consolidates a batch of more than 20 CVEs in the Gogs self-hosted Git server (BSI CERT-Bund, 2026-06-19). The most severe, CVE-2026-52806 (CWE-77 command injection; CVSS 4.0 9.4 per BSI, CVSS 3.1 9.9 per the GitHub advisory), lets a user craft a branch name containing a --exec Git flag that Gogs passes unsanitised to git rebase, yielding arbitrary OS command execution as the Gogs process owner when a rebase is triggered. Because Gogs ships with open self-registration enabled and no repository-count limit by default, the "authenticated" prerequisite is effectively eliminated on default-configured internet-exposed instances (GitHub Security Advisory GHSA-qf6p-p7ww-cwr9). All issues are fixed in Gogs 0.14.3 (released 2026-06-07; the BSI consolidation followed a May 2026 disclosure that the bugs were then unpatched). Gogs is common in EU research institutions, universities and smaller public-sector IT teams as a lightweight Git host. Upgrade to 0.14.3, set [service] DISABLE_REGISTRATION = true if registration is not required, run the Gogs process under a minimal-privilege shell-less user, and hunt for git child processes carrying --exec arguments.
CVE Summary Table
| CVE | Product | CVSS | EPSS | KEV | Exploited | Patch | Source |
|---|---|---|---|---|---|---|---|
| CVE-2026-12569 | PTC Windchill / FlexPLM | 10.0 (v3.1) / 9.3 (v4.0) | n/a | No | Yes (BSI/NCSC-CH confirmed) | 12.1.2.27 / 13.0.2.12 / 13.1.2.8 / 13.1.3.4 (2026-06-15) | Heise |
| CVE-2026-40624 | AVer PTC500S/PTC115/PTC500+/PTC115+ cameras | 9.8 (v3.1) | n/a | No | Unknown | Firmware update (all models) | CISA |
| CVE-2026-52806 | Gogs self-hosted Git server | 9.4 (v4.0) | n/a | No | Not observed | 0.14.3 (2026-06-07) | BSI |
Cited evidence
UPDATE (originally covered 2026-06-20): When this brief first covered the Gogs argument-injection RCE CVE-2026-52806 (branch name injects --exec into git rebase; fixed in 0.14.3 on 2026-06-07), exploitation status was not observed.
Updates1
When this brief first covered the Gogs argument-injection RCE CVE-2026-52806 (branch name injects --exec into git rebase; fixed in 0.14.3 on 2026-06-07), exploitation status was not observed. Wiz Threat Research now reports the flaw under active in-the-wild exploitation: a cryptojacking campaign active 2026-06-13–23 chained Gogs and Argo Workflows vulnerabilities for initial access, compromised thousands of Linux hosts, and pivoted across more than 300 additional Kubernetes nodes (Wiz Threat Research, 2026-06-28). The new development is the exploitation, not the bug; the CVE mechanics and patch were covered on 2026-06-20.
Per Wiz, once on a node the operators stole Kubernetes service-account tokens and used them to schedule workloads cluster-wide, then escaped to host via privileged containers to deploy cryptominers; Wiz designates the actor "Unknown" and names the C2 framework "Realm C2." The Gogs argument-injection vector is the same one documented by Rapid7, an authenticated (effectively unauthenticated on default open-registration instances) RCE via a malicious pull-request branch name during a "rebase before merging" operation (Rapid7 Labs). ATT&CK chain as reported: T1190 (exploit public-facing Argo Workflows / Gogs) → T1078.004 (stolen K8s service-account tokens) → T1610 (deploy container) → T1611 (escape to host) → T1496 (resource hijacking).
Defender delta since 2026-06-20: the patch urgency is now exploitation-driven, not advisory-driven. If self-hosted Gogs is still below 0.14.3, prioritise the upgrade and disable open self-registration (DISABLE_REGISTRATION = true). Hunt K8s API-server audit logs for create on workflows.argoproj.io and on pods from unexpected service accounts, git rebase child processes spawned by the Gogs service user, and privileged-container/nsenter activity. Enforce Pod Security Admission (restricted) and audit RBAC to remove default service accounts with node-escalation rights. Scope/attribution figures (thousands of hosts, 300+ nodes, "Realm C2") are Wiz's single-source assessment
Sources4
Revision history
- Published 2026-06-20-4cfd00ef
- Update 2026-06-29-6d39189a
Gogs argument-injection RCE (CVE-2026-52806), patched 2026-06-07 and first covered here on 2026-06-20 with no observed exploitation, is now actively exploited. Wiz Threat Research documents a cryptojacking campaign that chained Gogs and Argo Workflows to compromise thousands of Linux hosts and pivot across 300+ Kubernetes nodes via stolen service-account tokens. Self-hosted Gogs is common in EU research/university and smaller public-sector IT; if you have not yet upgraded to 0.14.3, the exploitation status has changed (Wiz Threat Research, 2026-06-28).
Changed: actions cves evidence priority regions sectors sources tags body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.