Gogs patches critical zero-day enabling remote code execution
Source Bleeping Computer
Fixed in 0.14.3 : patch affected systems as a priority.
Data as of 9 Jun 2026, 11:54 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 0.14.3
What to do
AI-suggested
A patch is available in Gogs version 0.14.3 released on June 7, 2026, which fixes this critical vulnerability. All users are strongly advised to upgrade immediately. For those unable to patch promptly, Rapid7 recommends disabling user registration (set DISABLE_REGISTRATION = true in app.ini) to prevent untrusted account creation and restricting repository creation (set MAX_CREATION_LIMIT = 0) to block the easiest attack vector. Auditing and managing rebase merge settings can provide limited mitigation but are not fully effective against malicious repository owners or admins. These mitigations reduce risk until the official patch can be applied.
Description
Gogs has patched a critical security zero-day flaw that can allow attackers to compromise Internet-facing instances and access any repositories (including private ones). [...]