Gogs, an open-source Git server, has recently been hit by a critical security vulnerability that could have far-reaching consequences for its users. This zero-day flaw, discovered by Rapid7 security researcher Jonah Burgess, allows attackers to exploit a critical vulnerability in the system, potentially compromising the security of all Gogs servers. The vulnerability, which has not yet been assigned a CVE ID, is a classic case of argument injection, a type of security flaw that can lead to remote code execution. This means that attackers could potentially gain full control over the server, access any repositories (including private ones), steal credentials, move laterally to other systems on the network, and alter any hosted source code.
What makes this vulnerability particularly dangerous is that it affects all Gogs releases up to and including 0.14.2 and 0.15.0+dev. The flaw is exploited by authenticated attackers without admin privileges, which means that even users with basic user privileges could potentially compromise the server. The fact that Gogs ships with open registration enabled by default and no limit on repository creation makes it even easier for attackers to exploit this vulnerability.
Burgess warned that an unauthenticated attacker can simply create an account and repository on any default-configured instance, and any registered user who creates a repo is automatically its owner. From there, enabling rebase merging is a single toggle in settings, and the entire exploit chain can be operated without interaction from any other user. This means that even a single user with basic privileges could potentially compromise the entire server.
The Gogs maintainers have released version 0.14.3 to patch this flaw, and they have requested a CVE ID. However, this is not a permanent solution, and Rapid7 has shared mitigation measures for users who cannot patch their Gogs instances immediately. These measures include restricting user registration and repository creation, as well as auditing rebase merge settings.
This is not the first time Gogs has been hit by a critical security vulnerability. In early December 2026, Gogs patched another RCE vulnerability (CVE-2025-8110) after it was exploited in zero-day attacks to compromise hundreds of servers. The fact that Gogs is often exposed online as a remote collaboration platform makes it an attractive target for attackers, and the fact that many instances are configured with 'Open Registration' enabled by default creates a massive attack surface.
The consequences of this vulnerability could be severe, and it is crucial for Gogs users to take immediate action to patch their instances and implement the recommended mitigation measures. The fact that this vulnerability is very similar to other argument-injection flaws that the Gogs security team has patched in recent years, but it affects a different code path (Merge()), means that it is even more important for users to be vigilant and take proactive steps to protect their servers.
In conclusion, the recent discovery of a critical security vulnerability in Gogs highlights the importance of staying vigilant and taking proactive steps to protect against potential threats. Users should take immediate action to patch their instances and implement the recommended mitigation measures to ensure the security of their servers and data.
