Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
What’s new: A critical RCE vulnerability has been disclosed in Gogs, allowing any authenticated user to execute arbitrary code by creating a malicious pull request. The flaw, rated 9.4 on the CVSS, does not have a CVE identifier and remains unpatched as of May 28, 2026.
Who’s affected
All supported platforms of Gogs, including Windows, Linux, and macOS, are impacted. There are approximately 1,141 internet-facing Gogs instances, with many more likely behind VPNs or internal networks.
What to do
- Restrict user registration by setting DISABLE_REGISTRATION = true in app.ini.
- Restrict repository creation by setting MAX_CREATION_LIMIT = 0 in app.ini.
- Audit rebase merge settings to prevent exploitation.
