CVE-2026-47267: Gogs Webhook SSRF Vulnerability – Bypass of Local Network Protection

Technical summary

CVE-2026-47267 is a Server-Side Request Forgery (SSRF) variant affecting Gogs webhooks. The vulnerability exists because the webhook validation logic, implemented to remediate CVE-2022-1285, fails to prevent attacks that leverage HTTP redirect responses. When a webhook is configured with a URL to an attacker-controlled external domain, that domain can return a redirect (HTTP 301/302/307) pointing to an internal hostname within private CIDR ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, etc.). The Gogs webhook client follows this redirect, bypassing hostname-based restrictions and enabling access to internal services. This is classified as CWE-918 (Server-Side Request Forgery), a fundamental control-plane security weakness.

Business impact

Organizations running Gogs prior to 0.14.3 face exposure of internal resources and data through webhook abuse. An attacker with repository access or the ability to influence webhook configuration can probe internal infrastructure, access metadata endpoints, exfiltrate secrets from internal services, or trigger denial-of-service conditions on backend systems. This is particularly dangerous in environments where Gogs interacts with CI/CD pipelines, internal APIs, or monitoring systems. The impact escalates in multi-tenant scenarios where untrusted users can create repositories.

Affected systems

Gogs versions prior to 0.14.3 are affected. The vulnerability requires network connectivity from the Gogs service to the internet (for initial outbound connection to the redirect source) and assumes the Gogs instance has network access to internal resources on private CIDR ranges. Self-hosted deployments are the primary concern, particularly those integrated with internal toolchains or operating on shared infrastructure.

Exploitability

Exploitability is moderate to high. The attack requires no privileges beyond repository access or webhook creation permissions; many Gogs deployments grant these to untrusted users. The attacker control surface is large—any external URL can be registered as a webhook. No user interaction is required. However, successful exploitation depends on network topology: the Gogs service must have east-west connectivity to internal targets, which is not universal across all deployments. The attack is straightforward to execute once webhook access is obtained.

Remediation

Upgrade Gogs to version 0.14.3 or later, which implements strict redirect handling for webhook URLs. After patching, verify webhook configurations do not point to known attacker-controlled domains. Review webhook logs for suspicious redirect patterns or unusual internal service access attempts. In environments unable to patch immediately, restrict webhook creation to trusted administrators, disable webhooks entirely if unused, and implement network segmentation to limit Gogs outbound access to necessary external services only.

Patch guidance

Verify the installed Gogs version by checking the Admin Dashboard or running `gogs --version`. If running a version prior to 0.14.3, download and deploy the patched version from the official Gogs repository. Test the upgrade in a non-production environment first, as webhook behavior may change. Restart the Gogs service to apply the patch. No database migrations are typically required for patch-level updates, but confirm compatibility with your deployment method (Docker, binary, or source).

Detection guidance

Review webhook configuration logs for URLs that include redirect chains or external domains. Analyze Gogs access logs for HTTP requests with Location/redirect headers pointing to private CIDR ranges. Monitor outbound connections from the Gogs service for unexpected internal IP targets. Look for webhook creation or modification events by non-administrator accounts. Implement webhook execution logging if not already enabled, and flag any webhook runs that result in HTTP 301/302/307 responses. Network-level detection can identify unusual outbound traffic from Gogs to internal services.

Why prioritize this

While not yet listed on CISA's Known Exploited Vulnerabilities catalog, this vulnerability merits urgent patching due to its high CVSS score (8.3), zero privilege requirements, and direct impact on infrastructure security boundaries. The bypass of previous security controls (CVE-2022-1285 fix) demonstrates active attacker interest in Gogs SSRF vectors. Organizations with public-facing Gogs instances or multi-tenant deployments should prioritize this immediately; single-user, air-gapped instances face lower risk.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects attack vector: network (AV:N), attack complexity: low (AC:L), and no privilege requirement (PR:N). The impact spans confidentiality, integrity, and availability (C:L/I:L/A:L), as successful exploitation enables information disclosure, manipulation of internal services, and potential DoS. The scope is changed (S:C), meaning the vulnerability can impact resources beyond the vulnerable component itself. This scoring appropriately captures the cross-network security boundary violation.

Frequently asked questions