Gogs 10.0 RCE and n8n Workflow-to-Code-Execution Flaws: Defender's Detection and Remediation Guide

This week's ThreatsDay roundup lands on a theme every defender should internalize: the most dangerous attacks increasingly abuse things your environment already trusts. Two critical code-execution flaws — one in the Gogs self-hosted Git service (version 10.0) and one in the n8n workflow automation platform — give attackers a path from network access to arbitrary code execution on infrastructure that typically sits deep inside the network, holding credentials, source code, CI/CD secrets, and automation tokens. Alongside these, the roundup highlights continued abuse of signed drivers to blind endpoint defenses, legitimate applications being co-opted to help malware blend in, and AI-assisted vulnerability research accelerating the pace at which exploit paths are discovered.

If your organization runs Gogs or n8n — and both are extremely popular in SMB and mid-market environments precisely because they're free and self-hosted — treat this as a patch-this-week event. Both platforms are frequently internet-exposed, both commonly run with excessive privileges, and both are high-value pivot points: compromise Gogs and you own the source code and likely the CI tokens; compromise n8n and you inherit every credential stored in every workflow.

Technical Analysis

Gogs 10.0 — Critical Remote Code Execution

Gogs is a lightweight, self-hosted Git service written in Go, widely deployed as a lightweight alternative to GitLab. Version 10.0 was released with a critical code-execution flaw. Based on the reporting, the weakness involves insufficient validation of input handled by the web application — a class of issue that in Git hosting platforms typically manifests through repository operations, webhooks, or the built-in SSH/HTTP interfaces.

From a defender's perspective, the attack chain looks like this:

1. Attacker reaches the Gogs web interface (port 3000 by default) — either directly over the internet or via an internal foothold.
2. A crafted request to the vulnerable component triggers server-side code execution in the context of the git service account (or whatever account runs the Gogs process).
3. Post-exploitation typically involves pulling the Gogs database (which stores user credentials and access tokens), reading repositories (source code, hardcoded secrets), and planting persistence via Git hooks — server-side hook scripts in repositories execute on push events and are an ideal, rarely-monitored persistence location.

Exploitation requirements are low: the flaw is network-reachable and, per the reporting, does not require sophisticated preconditions. Gogs instances are routinely indexed by Shodan/Censys — internet-exposed instances should be assumed to be under active scanning pressure within days of disclosure.

n8n — Workflow-to-Critical Code Execution

n8n is an automation platform (think self-hosted Zapier) that lets users build workflows connecting SaaS APIs, databases, and internal systems. The disclosed flaw allows a path from workflow manipulation to code execution on the host. The critical detail from the reporting: a weak header check opens the path to code execution — meaning an attacker who can reach the n8n instance and pass a trivially forged HTTP header can abuse functionality that was intended to be restricted.

Why this is severe in practice:

• n8n's Execute Command and Code nodes are designed to run arbitrary shell commands and JavaScript on the host. Any auth-bypass or header-validation flaw that lets an attacker create or modify workflows is effectively RCE by design.
• n8n stores credentials for every integrated service — Slack, AWS, databases, SMTP, SSH keys — in its database. A single compromise harvests the keys to the kingdom.
• Many deployments run n8n in Docker with the default port 5678 exposed, frequently without the built-in authentication properly enforced, and often with N8N_BASIC_AUTH disabled or weakly configured.

Signed Driver Abuse (BYOVD) and Living-off-the-Land

The roundup also calls out signed drivers being turned against defenses — the BYOVD (Bring Your Own Vulnerable Driver) technique — and legitimate applications being abused to let malicious software blend in. In BYOVD attacks, threat actors install a legitimately signed but vulnerable kernel driver, then exploit it to gain kernel-level access and terminate or blind EDR/AV processes. This remains a favored technique of ransomware operators in 2025–2026 precisely because the driver carries a valid signature and sails past naive allow-listing.

Exploitation Status

At the time of this roundup, the Gogs and n8n flaws are publicly disclosed and documented by security researchers, which historically means scanning and exploitation attempts follow within days. Neither flaw has an official CVE identifier cited in the source reporting at publication time — track the vendor advisories linked below for CVE assignment and CISA KEV status. Treat both as "actively targeted" for prioritization purposes: internet-facing DevOps and automation tooling is among the fastest-exploited categories we see in incident response.

Detection & Response

Sigma Rules

The following rules target the highest-fidelity post-exploitation behaviors for both flaws: the Gogs or n8n service processes spawning shells, and server-side Git hook execution — the most common persistence mechanism after a Git-server compromise.

---
title: Gogs Service Process Spawning Shell or Command Interpreter
id: 3f8a2c41-7b1d-4e9a-a2c6-9d4e5f6a7b8c
status: experimental
description: Detects the Gogs service process spawning a shell, script interpreter, or download utility, consistent with post-exploitation of the Gogs 10.0 remote code execution flaw.
references:
  - https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'gogs web'
      - '/gogs'
      - 'gogs serv'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'curl '
      - 'wget '
      - 'python'
      - 'perl'
      - 'nc '
      - 'ncat'
      - 'base64'
  condition: selection_parent and selection_child
falsepositives:
  - Gogs server-side repository hooks legitimately invoking scripts during push events
level: high
---
title: n8n Process Spawning Shell or Command Interpreter
id: 6d1e4b92-3c5f-4a78-b1d2-8e3f4a5b6c7d
status: experimental
description: Detects the n8n workflow automation process spawning shells or system utilities, indicating execution via the workflow-to-code-execution flaw or a malicious Execute Command node created by an attacker.
references:
  - https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'n8n'
      - 'node'
  selection_parent_path:
    ParentCommandLine|contains: 'n8n'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'curl '
      - 'wget '
      - 'chmod +x'
      - 'base64 -d'
      - 'crontab'
      - 'ssh '
  condition: selection_parent and selection_parent_path and selection_child
falsepositives:
  - Legitimate Execute Command nodes in approved workflows; baseline known workflow commands and alert on deviations
level: high
---
title: Server-Side Git Hook Execution as Persistence
id: 9c2b7d15-4e6a-4f81-c3d4-5a6b7c8d9e0f
status: experimental
description: Detects execution of scripts from Git repository server-side hook directories, a common persistence mechanism planted after compromise of self-hosted Git services such as Gogs.
references:
  - https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html
  - https://attack.mitre.org/techniques/T1546/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1546
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '/hooks/post-receive'
      - '/hooks/pre-receive'
      - '/hooks/update'
      - '/hooks/post-update'
  filter_known_hooks:
    CommandLine|contains:
      - 'hooks/post-receive.d/'
  condition: selection and not filter_known_hooks
falsepositives:
  - Legitimate CI/CD integration hooks; maintain an inventory of approved hook scripts per repository
level: medium

KQL Hunt Query (Microsoft Sentinel / Defender)

This query hunts Syslog (for Linux hosts forwarding process audit data) for the service-spawns-shell pattern across both Gogs and n8n, plus suspicious inbound connections to default service ports seen in CommonSecurityLog from network devices.

// Hunt: Gogs / n8n post-exploitation — service process spawning shells and suspicious inbound hits
let suspiciousChildren = dynamic(["/bin/sh", "/bin/bash", "curl", "wget", "nc ", "ncat", "python", "perl", "base64", "crontab", "chmod +x"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(7d)
    | where ProcessName has_any ("gogs", "n8n", "node")
        or SyslogMessage has_any ("gogs web", "gogs serv", "n8n start")
    | where SyslogMessage has_any (suspiciousChildren)
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP),
    (CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where DestinationPort in (3000, 5678)
    | where DeviceAction !in ("deny", "blocked", "drop")
    | summarize ConnectionCount = count(), SourceIPs = make_set(SourceIP, 20) by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
    | where ConnectionCount > 50
    | project TimeGenerated, DestinationIP, DestinationPort, ConnectionCount, SourceIPs)
| sort by TimeGenerated desc

A second, tighter query for the header-bypass pattern on n8n — look for unauthenticated or anomalous workflow creation/modification in web logs ingested into Sentinel:

// Hunt: anomalous POST activity against n8n REST API (workflow creation/modification)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 5678
| where RequestMethod == "POST"
| where RequestURL has_any ("/rest/workflows", "/api/v1/workflows", "/rest/executions")
| summarize Requests = count(), DistinctSources = dcount(SourceIP) by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where Requests > 10 or DistinctSources > 3
| sort by Requests desc

Velociraptor VQL Hunt

Use this artifact across your Linux fleet (via Velociraptor's Linux process and filesystem accessors) to find Gogs/n8n processes with suspicious children and recently modified server-side Git hooks — the two artifacts that survive reboot and reveal both active compromise and persistence.

-- Hunt: Gogs/n8n suspicious child processes and modified Git hook persistence
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(/bin/(ba)?sh|curl|wget|ncat|nc |python|perl|base64|crontab)'
  AND (CommandLine =~ '(?i)gogs|n8n' OR Ppid IN (
      SELECT Pid FROM pslist() WHERE CommandLine =~ '(?i)gogs|n8n start|node.*n8n'
  ))

LET hooks = SELECT FullPath, Mtime, Size
FROM glob(globs=['/home/git/gogs-repositories/**/*.git/hooks/post-receive',
                 '/home/git/gogs-repositories/**/*.git/hooks/pre-receive',
                 '/var/lib/gogs/**/*.git/hooks/post-receive',
                 '/opt/gogs/**/*.git/hooks/post-receive',
                 '/home/*/.gogs/**/*.git/hooks/post-receive'])
WHERE Mtime > now() - 60*60*24*14

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'hook_artifact' AS Name, FullPath AS CommandLine,
       NULL AS Exe, NULL AS Username, Mtime AS CreateTime
FROM hooks

Remediation & Verification Script

Run this Bash script on any Linux host to inventory Gogs and n8n exposure, check versions, flag internet-reachable listeners, and audit Git hooks for unexpected content. It is read-only by design — review output before making changes.

#!/bin/bash
# security-arsenal-gogs-n8n-audit.sh — verify exposure and basic hygiene for Gogs and n8n
set -euo pipefail

echo "=== [1] Listening services on default ports (Gogs 3000, n8n 5678) ==="
ss -tlnp 2>/dev/null | grep -E ':(3000|5678)\b' || echo "No listeners on 3000/5678"

echo
echo "=== [2] Gogs version check ==="
if command -v gogs >/dev/null 2>&1; then
  gogs --version
else
  find /opt /home /var/lib -maxdepth 4 -name 'gogs' -type f 2>/dev/null | while read -r bin; do
    echo "Found: $bin"; "$bin" --version 2>/dev/null || true
  done
fi

echo
echo "=== [3] n8n version and auth configuration ==="
if command -v n8n >/dev/null 2>&1; then
  n8n --version
fi
env | grep -iE '^N8N_(BASIC_AUTH|USER_MANAGEMENT|ENCRYPTION_KEY|HOST|PORT)' || \
  echo "No N8N_* auth env vars set — verify authentication is enforced in n8n config"

echo
echo "=== [4] Docker deployments ==="
if command -v docker >/dev/null 2>&1; then
  docker ps --format '{{.Names}}\t{{.Image}}\t{{.Ports}}' 2>/dev/null | grep -iE 'gogs|n8n' || \
    echo "No Gogs/n8n containers running"
fi

echo
echo "=== [5] Git server-side hooks modified in the last 14 days (persistence audit) ==="
for base in /home/git /var/lib/gogs /opt/gogs; do
  [ -d "$base" ] || continue
  find "$base" -path '*/hooks/*' -type f -mtime -14 2>/dev/null \
    | grep -vE '\.sample$' | while read -r hook; do
      echo "REVIEW: $hook (mtime: $(stat -c %y "$hook"))"
  done
done

echo
echo "=== [6] Egress connections from service accounts (git/node) ==="
ss -tnp 2>/dev/null | grep -iE 'gogs|n8n|node' | grep -v 'LISTEN' || echo "No active outbound connections"

echo
echo "Audit complete. Cross-reference findings with your approved baseline."

Remediation

Gogs — immediate actions:

1. Upgrade to the latest patched Gogs release. Check the official project releases at https://github.com/gogs/gogs/releases and the Gogs security advisories page. If your deployment is on 10.0 or earlier, upgrade this week. If you build from source, pull the current release tag and rebuild.
2. Remove Gogs from direct internet exposure. Place it behind a VPN, zero-trust gateway, or at minimum an authenticating reverse proxy. Run ss -tlnp | grep 3000 on every host; if port 3000 answers on a public interface, you have a problem.
3. Rotate credentials after patching. Gogs stores user passwords and access tokens in its database (SQLite by default at data/gogs.db). If the instance was internet-reachable and unpatched, rotate all user passwords, all personal access tokens, and — critically — any deploy keys or CI tokens that had repository access.
4. Audit server-side Git hooks. Enumerate every non-.sample file under */hooks/ in your repository storage path. Anything you didn't deliberately deploy is an incident.
5. Review Gogs logs (default log/ directory) for anomalous requests around the disclosure window and check for newly created admin accounts: SELECT * FROM user WHERE is_admin = 1; against the Gogs database.

n8n — immediate actions:

1. Upgrade to the latest n8n release. Pull the newest Docker image (n8nio/n8n:latest — verify the digest) or run npm update -g n8n. Track the advisory at https://docs.n8n.io/release-notes/ and the n8n GitHub security advisories.
2. Enforce authentication properly. Ensure N8N_USER_MANAGEMENT_DISABLED is not set, owner account setup is complete, and any basic-auth or SSO layer in front of n8n cannot be bypassed via forged headers. Given the weak-header-check nature of this flaw, audit your reverse proxy: strip or explicitly control X-Forwarded-* and any custom auth headers at the edge so clients cannot inject them. In nginx: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; and explicitly remove any headers your auth layer trusts that clients could set.
3. Constrain execution. If workflows do not require it, disable the Execute Command node via the NODES_EXCLUDE environment variable (NODES_EXCLUDE="[\"n8n-nodes-base.executeCommand\"]"), and never run n8n as root — run the container with a non-root user and a read-only root filesystem where feasible.
4. Rotate stored credentials. If the instance was exposed and unpatched, assume the n8n credential store is compromised. Rotate every credential configured in n8n: API keys, OAuth tokens, database passwords, SSH keys.
5. Audit workflows for anything you didn't create: n8n export:workflow --all --output=/tmp/audit/ and diff against your known-good inventory. Look for new Execute Command nodes, unexpected webhook triggers, and scheduled workflows.

Signed-driver / BYOVD defense:

1. Enable Microsoft's Vulnerable Driver Blocklist (Windows Defender Application Control) on all endpoints — it is on by default on new installs but frequently disabled on upgraded systems. Verify via registry: HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable = 1.
2. Alert on driver loads that are not on your approved baseline. The Sigma rule family Driver Load - Vulnerable Driver in the SigmaHQ repository provides a maintained detection baseline.
3. Monitor for EDR tampering: unexpected service stops, sensor process termination, and deletion of EDR drivers are high-fidelity precursors to ransomware detonation.

Network-level compensating controls (both platforms):

• Egress-filter DevOps and automation hosts. A Git server or workflow engine has no business initiating outbound connections to arbitrary internet hosts — allowlist package registries and required SaaS endpoints only.
• Ensure both services forward logs to your SIEM. Gogs access logs and n8n execution logs are the ground truth during triage; local-only logs get wiped first.
• Add both assets to your vulnerability management scanner's authenticated scan scope — unauthenticated scans routinely miss self-hosted application version disclosure.

CISA KEV / deadlines: No CISA KEV entry or federal remediation deadline is cited in the source reporting at publication time. Monitor https://www.cisa.gov/known-exploited-vulnerabilities-catalog and the vendor advisories above; if either flaw is added to KEV, the standard BOD 22-01 remediation clock applies to federal agencies and is a sound internal SLA for everyone else.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub