Gogs Has a 9.4-Severity RCE Hole — And Nobody's Patching It
A single malicious branch name is all it takes for any authenticated user to seize full control of a Gogs server.
Written by OutOfToken AI
June 6, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
A critical remote code execution vulnerability in Gogs, the lightweight self-hosted Git service used by thousands of development teams worldwide, has been publicly disclosed with no patch in sight. Rated 9.4 on the CVSS scale by Rapid7, the flaw hands arbitrary code execution to any authenticated user — no privilege escalation required, no complex exploit chain needed. What makes this particularly dangerous is Gogs' default configuration: open registration is enabled out of the box, meaning the attacker pool is effectively anyone on the internet who can reach the instance.
How the Attack Actually Works
The vulnerability lives in Gogs' handling of the 'Rebase before merging' merge operation. When a user creates a pull request, Gogs passes the branch name directly into a git rebase command without adequate sanitization. An attacker can craft a branch name that injects the --exec flag into that git invocation — a classic argument injection pattern. Git's --exec flag instructs rebase to run an arbitrary shell command after each commit is replayed, so the payload executes with the same operating system privileges as the Gogs server process itself. The attack requires no special role, no admin token, and no pre-existing foothold beyond a valid account on the target instance.
The Open Registration Problem Multiplies the Risk
Gogs ships with DISABLE_REGISTRATION set to false, which means any instance that hasn't been explicitly hardened accepts new user accounts from the public. That architectural default transforms what would otherwise be an insider threat into a fully external attack surface. An adversary needs only to register an account, create a repository, open a pull request against another repo, and trigger a rebase merge — a workflow any developer would recognize as completely routine. There is no anomalous behavior to flag until the payload fires. Instances that host private repositories, CI/CD credentials, or internal tooling configurations are at particular risk of full data exfiltration the moment a malicious merge request lands.
""The vulnerability allows any authenticated user to achieve remote code execution on the server" — Rapid7 research disclosure, CVSS 9.4, currently unpatched."
No CVE, No Fix, and Questions About Disclosure
Unusually for a flaw of this severity, the vulnerability carries no CVE identifier at the time of writing. Critical findings rated above 9.0 typically receive CVE assignments within days of disclosure; the absence here suggests either a breakdown in coordinated disclosure with Gogs maintainers or a deliberate decision to publish without waiting for the identifier process to complete. Rapid7 has confirmed the vulnerability is unpatched as of its disclosure date, and the Gogs project — a smaller open-source effort compared to Gitea, from which it was originally forked — has not issued a public advisory or emergency release. Administrators cannot rely on a vendor fix as a mitigation path right now, which shifts the entire burden of protection onto deployment-level controls.
Until the Gogs maintainers ship a remediated release, every internet-exposed instance running with default settings should be treated as compromised in waiting. The immediate playbook is blunt but clear: disable open registration, restrict access to trusted networks or VPNs, and audit whether any external users already have accounts on the system. For organizations evaluating alternatives, Gitea — the actively maintained fork — has a more responsive security track record and a larger contributor base. The deeper lesson here cuts across the entire self-hosted tooling ecosystem: a single unsanitized string passed to a shell command can unravel the security of every repository, secret, and pipeline credential sitting on that server.
Editorial Note
The Hacker News is a reputable cybersecurity news aggregator with generally reliable reporting. Gogs is a legitimate open-source Git service that has had documented vulnerabilities. However, the absence of a CVE identifier is unusual for a claimed critical vulnerability (CVSS 9.4), which warrants caution—critical flaws typically receive CVE assignments relatively quickly, though timing can vary.
Claim Tracker
AI-assessed
Rapid7 is a credible security firm; rating can be independently verified through their disclosure
CVE assignment is ongoing; status may change post-publication
Gogs documentation confirms open registration is the default configuration
Technical details provided but no independent source or proof-of-concept referenced in excerpt
No source provided; vague quantifier; actual user base unclear
Ask AI about this story
// discussion
sign in to join the discussion