---
schema: 1
kind: vulnerability
title: >
  CVE-2026-52806 — Gogs self-hosted Git server: argument injection to OS command execution (BSI
  critical batch)
headline: >
  CVE-2026-52806 — Gogs self-hosted Git server: argument injection to OS command execution (BSI
  critical batch)
summary: >
  BSI advisory WID-SEC-2026-2013 (rated kritisch, 2026-06-19) consolidates a batch of more than 20
  CVEs in the Gogs self-hosted Git server (BSI CERT-Bund, 2026-06-19).
discovered_at: "2026-06-20T05:12:15Z"
updated_at: "2026-06-29T04:47:15Z"
event_date: 2026-06-19
run_id: 2026-06-20-4cfd00ef
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - rce
  - default-config
  - actively-exploited
  - cloud
  - cryptocrime
regions:
  - europe
  - dach
  - global
sectors:
  - education
  - technology
  - public-sector
entities: []
techniques: []
affected_products: []
cves:
  - id: CVE-2026-52806
    cvss: "9.4"
    epss: null
    type: rce
    vector: user-interaction
    auth: default-config
    status:
      - exploited
      - patch-available
sources:
  - url: "https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9"
    publisher: GitHub Security Advisory GHSA-qf6p-p7ww-cwr9
    role: primary
  - url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2013"
    publisher: BSI CERT-Bund WID-SEC-2026-2013
    role: corroborating
  - url: "https://threats.wiz.io/all-incidents/cryptojacking-campaign-targeting-k8s-clusters"
    publisher: Wiz Threat Research
    role: primary
  - url: "https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/"
    publisher: Rapid7 Labs
    role: corroborating
closed_sources: []
evidence:
  - quote: "UPDATE (originally covered 2026-06-20): When this brief first covered the Gogs argument-injection RCE CVE-2026-52806 (branch name injects --exec into git rebase; fixed in 0.14.3 on 2026-06-07), exploitation status was not observed."
    publisher: ctipilot v2 brief (migrated)
verification: multi-source
sourcing_note: null
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification: null
watchlist_hit: false
actions:
  - "**Upgrade self-hosted Gogs to 0.14.3** (CVE-2026-52806) and disable open self-registration (`DISABLE_REGISTRATION = true`) on internet-exposed instances."
  - "**Upgrade self-hosted Gogs to 0.14.3 now if not already done — exploitation status changed.** CVE-2026-52806 is now actively exploited (§ 4); disable open self-registration (`DISABLE_REGISTRATION = true`) on any internet-exposed instance and hunt for `git rebase`/`--exec` child processes under the Gogs service user. Common in EU research, university and smaller public-sector Git hosting."
updates:
  - at: "2026-06-29T04:47:15Z"
    run_id: 2026-06-29-6d39189a
    type: update
    summary: >
      Gogs argument-injection RCE (CVE-2026-52806), patched 2026-06-07 and first covered here on
      2026-06-20 with no observed exploitation, is now actively exploited. Wiz Threat Research
      documents a cryptojacking campaign that chained Gogs and Argo Workflows to compromise thousands
      of Linux hosts and pivot across 300+ Kubernetes nodes via stolen service-account tokens.
      Self-hosted Gogs is common in EU research/university and smaller public-sector IT; if you have
      not yet upgraded to 0.14.3, the exploitation status has changed (Wiz Threat Research,
      2026-06-28).
    fields:
      - actions
      - cves
      - evidence
      - priority
      - regions
      - sectors
      - sources
      - tags
      - body
    merged_from: 2026-06-29/gogs-cve-2026-52806-moves-from-no-observed-exploitation-to-a
migrated_from: briefs/2026-06-20.md
---

BSI advisory WID-SEC-2026-2013 (rated *kritisch*, 2026-06-19) consolidates a batch of more than 20 CVEs in the Gogs self-hosted Git server ([BSI CERT-Bund, 2026-06-19](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2013)). The most severe, CVE-2026-52806 (CWE-77 command injection; CVSS 4.0 9.4 per BSI, CVSS 3.1 9.9 per the GitHub advisory), lets a user craft a branch name containing a `--exec` Git flag that Gogs passes unsanitised to `git rebase`, yielding arbitrary OS command execution as the Gogs process owner when a rebase is triggered. Because Gogs ships with open self-registration enabled and no repository-count limit by default, the "authenticated" prerequisite is effectively eliminated on default-configured internet-exposed instances ([GitHub Security Advisory GHSA-qf6p-p7ww-cwr9](https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9)). All issues are fixed in Gogs 0.14.3 (released 2026-06-07; the BSI consolidation followed a May 2026 disclosure that the bugs were then unpatched). Gogs is common in EU research institutions, universities and smaller public-sector IT teams as a lightweight Git host. Upgrade to 0.14.3, set `[service] DISABLE_REGISTRATION = true` if registration is not required, run the Gogs process under a minimal-privilege shell-less user, and hunt for `git` child processes carrying `--exec` arguments.


#### CVE Summary Table

| CVE | Product | CVSS | EPSS | KEV | Exploited | Patch | Source |
|---|---|---|---|---|---|---|---|
| CVE-2026-12569 | PTC Windchill / FlexPLM | 10.0 (v3.1) / 9.3 (v4.0) | n/a | No | Yes (BSI/NCSC-CH confirmed) | 12.1.2.27 / 13.0.2.12 / 13.1.2.8 / 13.1.3.4 (2026-06-15) | [Heise](https://www.heise.de/en/news/PTC-Windchill-BSI-calls-admins-at-night-due-to-critical-security-vulnerability-11338329.html) |
| CVE-2026-40624 | AVer PTC500S/PTC115/PTC500+/PTC115+ cameras | 9.8 (v3.1) | n/a | No | Unknown | Firmware update (all models) | [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-01) |
| CVE-2026-52806 | Gogs self-hosted Git server | 9.4 (v4.0) | n/a | No | Not observed | 0.14.3 (2026-06-07) | [BSI](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2013) |

## Update — 2026-06-29T04:47:15Z

When this brief first covered the Gogs argument-injection RCE CVE-2026-52806 (branch name injects `--exec` into `git rebase`; fixed in 0.14.3 on 2026-06-07), exploitation status was *not observed*. Wiz Threat Research now reports the flaw under active in-the-wild exploitation: a cryptojacking campaign active 2026-06-13–23 chained Gogs and Argo Workflows vulnerabilities for initial access, compromised thousands of Linux hosts, and pivoted across more than 300 additional Kubernetes nodes ([Wiz Threat Research, 2026-06-28](https://threats.wiz.io/all-incidents/cryptojacking-campaign-targeting-k8s-clusters)). The new development is the exploitation, not the bug — the CVE mechanics and patch were covered on 2026-06-20.

Per Wiz, once on a node the operators stole Kubernetes service-account tokens and used them to schedule workloads cluster-wide, then escaped to host via privileged containers to deploy cryptominers; Wiz designates the actor "Unknown" and names the C2 framework "Realm C2." The Gogs argument-injection vector is the same one documented by Rapid7 — an authenticated (effectively unauthenticated on default open-registration instances) RCE via a malicious pull-request branch name during a "rebase before merging" operation ([Rapid7 Labs](https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/)). ATT&CK chain as reported: [T1190](https://attack.mitre.org/techniques/T1190/) (exploit public-facing Argo Workflows / Gogs) → [T1078.004](https://attack.mitre.org/techniques/T1078/004/) (stolen K8s service-account tokens) → [T1610](https://attack.mitre.org/techniques/T1610/) (deploy container) → [T1611](https://attack.mitre.org/techniques/T1611/) (escape to host) → [T1496](https://attack.mitre.org/techniques/T1496/) (resource hijacking).

Defender delta since 2026-06-20: the patch urgency is now exploitation-driven, not advisory-driven. If self-hosted Gogs is still below 0.14.3, prioritise the upgrade and disable open self-registration (`DISABLE_REGISTRATION = true`). Hunt K8s API-server audit logs for `create` on `workflows.argoproj.io` and on `pods` from unexpected service accounts, `git rebase` child processes spawned by the Gogs service user, and privileged-container/`nsenter` activity. Enforce Pod Security Admission (`restricted`) and audit RBAC to remove default service accounts with node-escalation rights. Scope/attribution figures (thousands of hosts, 300+ nodes, "Realm C2") are Wiz's single-source assessment