CVE-2026-52805 Gogs: Migration Redirect Bypass Leads to Internal Repository Theft
An authenticated user can exploit SSRF in repository migration to steal internal repository contents via redirect bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-52805?
CVE-2026-52805 is a high-severity server-side request forgery vulnerability in gogs, published on 24 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated user can submit a public URL that redirects to a blocked internal endpoint (e.g., 127.0.0.1), importing the internal repository's contents into an attacker-controlled repository. This vulnerability is fixed in 0.14.3.
Weakness: CWE-918
Which versions are affected by CVE-2026-52805?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.3 |
gogs.io/gogs Go | All versions | 0.14.3 |
How do I fix CVE-2026-52805?
Upgrade gogs.io/gogs to 0.14.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-52805 being exploited?
There is no known exploitation of CVE-2026-52805 in the wild and no public exploit code.
Sources
Also known as GHSA-g2f5-gjr4-qjvm, GO-2026-5387.