Critical Gogs RCE (CVSS 9.4): No CVE ID Yet - Detection & Mitigation
Just caught the Rapid7 disclosure on a critical Remote Code Execution (RCE) vulnerability in Gogs. With a CVSS score of 9.4, this is a nasty one for anyone still running self-hosted instances, especially given the ease of exploitation.
The catch? It currently has no CVE identifier assigned yet. That is going to complicate vulnerability management and SBOM tracking significantly for the next few days. The flaw allows any authenticated user to execute arbitrary code on the underlying server. Given that many Gogs instances allow open registration or have weak password policies, this effectively turns your Git server into a beachhead.
Until the scanners catch up with a CVE ID, we are relying on behavior-based detection. If you are using a SIEM, you should be hunting for the Gogs binary spawning child processes it shouldn't. Here is a basic KQL query to flag suspicious shell activity from the Gogs user context:
DeviceProcessEvents
| where InitiatingProcessFileName has "gogs"
| where ProcessFileName in~ ("bash", "sh", "powershell", "pwsh", "cmd")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
This assumes your Gogs service runs under a dedicated user account (which it absolutely should be).
Since Gogs development has slowed down significantly in favor of forks like Gitea, is anyone else using this as a catalyst to finally migrate their repos? Or are you planning to patch in-place?
Solid query. We've already seen similar IoCs with the recent GitLab auth bypasses. I'd recommend adding specific exclusion rules for your CI/CD runners if you allow them to execute hooks, otherwise, your SOC will be drowning in false positives. We're treating this as 'assume breach' for any Gogs instance that has public signup enabled.
The lack of a CVE is frustrating for ticketing, but the risk is real. We're going to enforce 2FA on our internal instance immediately to mitigate the 'any authenticated user' risk. If an attacker gets creds, at least they hit the MFA wall before they can hit the RCE. Also, check your app.ini—disabling ENABLE_REGISTER is a quick temporary band-aid if you can't patch right now.
Honestly, if you're still on Gogs in 2026, you're asking for trouble. The project is effectively dead compared to Gitea or Forgejo. We moved our last client to Forgejo last month. It's a hard fork that stays true to open source, and it imports Gogs data seamlessly. Don't waste time patching legacy tech; just migrate.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access