CVE-2026-52806: Critical RCE in Gogs via git rebase Argument Injection During PR Merge

Vulnerability Overview

CVE-2026-52806 is a critical command injection vulnerability (CWE-77, CVSS 9.9) in the Gogs self-hosted Git service. The root cause is insufficient sanitisation of user-controlled input passed to the git rebase --exec argument during pull request merge operations. An authenticated attacker who can open or influence a pull request can inject arbitrary shell commands that execute with the privileges of the Gogs server process, achieving full remote code execution (RCE) on the host.

The impact is severe: a successful exploit grants an attacker arbitrary command execution on the server running Gogs, potentially exposing all hosted repositories, credentials, CI/CD secrets, and downstream infrastructure.

Affected Software

• Vendor: Gogs (gogs.io/gogs)
• Affected versions: All releases prior to 0.14.3
• Fixed version: 0.14.3 (patch status at time of writing: not yet confirmed released — verify against upstream)

Exploitation Status

A public proof-of-concept (PoC) exploit is available. Disclosed on 23 June 2026, this vulnerability moved from theoretical to practically exploitable within days of publication. Defenders should treat any unpatched Gogs instance as actively at risk — public PoC availability dramatically lowers the barrier for opportunistic attackers and automated exploitation campaigns. Prioritise patching or isolation immediately.

Detection Coverage

Our detection package for CVE-2026-52806 ships rules across seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates process creation events for git rebase invocations containing --exec with shell metacharacters, scoped to processes spawned by the Gogs service account.
• Splunk (SPL) — searches process and command-line telemetry for anomalous git rebase --exec argument patterns associated with the Gogs process tree.
• Elastic (EQL) — sequence rule linking a Gogs web process to a child git process with suspicious --exec payloads, reducing noise from legitimate rebase activity.
• IBM QRadar (AQL) — event query targeting command-line fields for injection markers within git subprocess activity originating from Gogs.
• Sumo Logic — log search rule keyed on Gogs application logs and OS-level process telemetry for rebase exec injection patterns.
• Chronicle (YARA-L) — behavioural rule correlating Gogs HTTP merge events with subsequent anomalous child process spawning on the same host.
• CrowdStrike (CQL) — Falcon sensor query detecting git rebase --exec with shell operator characters in child processes of the Gogs binary.

All rules are tuned to minimise false positives from legitimate developer rebase workflows while surfacing the specific argument injection pattern introduced by this CVE.

Recommended Action

Upgrade Gogs to version 0.14.3 or later immediately. If patching is not immediately possible, restrict merge permissions to trusted users and consider isolating the Gogs instance from broader network segments until the patch is applied.

Full detection logic, MITRE ATT&CK mapping (including technique and sub-technique coverage), KQL/SPL/EQL/AQL queries, and purple team playbooks are available on the CVE-2026-52806 detection page.