Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
A critical Gogs flaw lets authenticated users trigger remote code execution through malicious branch names during rebase merges.
Intelligence analysis by GPT-5.4 Mini
Rapid7 says a 9.4-rated Gogs vulnerability can let any authenticated user execute arbitrary code by abusing the service's rebase-before-merging path. The issue can expose repositories, credentials, and other tenants' private data, and it remains unpatched.
Gogs is like a shared workshop where people store and update code. A bug in how it handles one special kind of merge lets a logged-in person sneak in a command that the server should never run.
That matters because a small change in a branch name can turn into a big break-in. It is a bit like writing a fake label on a package that tricks the warehouse robot into doing extra work it should not do.
If someone abuses this, they may get into the whole workshop, steal secrets, and mess with other people's code. The article says the fix is not out yet, so keeping accounts and repository creation locked down is the main defense for now.
Analysis
What happened
Rapid7 disclosed a critical vulnerability in Gogs, the open-source self-hosted Git service, that can let an authenticated user execute arbitrary code on the server under certain conditions. The issue is rated 9.4 on CVSS and, according to the report, does not yet have a CVE.
How the bug works
The weakness sits in Gogs' "Rebase before merging" flow. Security researcher Jonah Burgess said an attacker can create a pull request with a malicious branch name that injects the --exec flag into git rebase. Because git rebase can run a shell command after each replayed commit, the attacker can steer the merge operation into command execution.
The article says the attack does not require admin access or another user's interaction. On a default-configured instance, a threat actor can register an account, create a repository, and become its owner automatically. From there, enabling rebase merging is described as a single toggle. If repository creation is restricted, the attacker needs write access to a repository that already has rebase merging enabled.
Impact and exposure
Successful exploitation could let an attacker breach the server, access all repositories on the instance, dump credentials, move to other reachable systems, and alter hosted code. Rapid7 also warns about cross-tenant exposure on shared servers, where one user's private repositories could be read by another.
The issue reportedly affects supported platforms including Windows, Linux, and macOS. Rapid7 estimates 1,141 internet-facing Gogs instances, though the real number may be higher because many deployments sit behind VPNs or internal networks.
Mitigations and tooling
Because the flaw is unpatched as of the article's publication and was reported to the maintainer on March 17, 2026, the guidance is to reduce exposure: disable public registration, limit repository creation, and audit rebase merge settings. Rapid7 also released a Metasploit module that automates the exploit chain on Linux and Windows targets, including a mode that creates and deletes a temporary attacker-owned repository, leaving only an HTTP 500 in logs.
Key points
- Rapid7 disclosed a 9.4-rated Gogs vulnerability that can lead to remote code execution.
- The flaw can be triggered through malicious branch names during "Rebase before merging."
- Exploitation may work for any authenticated user, and sometimes with only write access to an existing repository.
- Potential impact includes server compromise, credential theft, repository tampering, and cross-tenant data exposure.
- Rapid7 released a Metasploit module, and the article says the bug remains unpatched.
