CVE-2026-52805: Gogs SSRF in Repository Migration (Redirect Bypass)

Technical summary

The vulnerability stems from incomplete URL validation in Gogs' repository migration handler. The application checks the hostname of the initially submitted URL against a blocklist or allowlist but does not validate the destination after HTTP redirects. Since git clone --mirror respects HTTP 3xx redirects by default, an attacker can craft a request with a public URL that redirects via 302/301/307 to an internal address (e.g., http://127.0.0.1:3000/internal-repo.git). The git process follows the redirect transparently, and Gogs does not intercept or validate the final destination. This allows the attacker to mirror internal repositories whose contents are then accessible via the attacker's account. The root cause is CWE-918 (Server-Side Request Forgery), specifically the failure to re-validate URLs after redirects.

Business impact

This vulnerability poses a significant data confidentiality and integrity risk for organizations self-hosting Gogs in environments where internal repositories contain sensitive code, credentials, or proprietary logic. An insider or compromised account can exfiltrate internal repositories by creating seemingly legitimate migration requests. The attack requires authentication, so it is not a wormable vulnerability, but any valid Gogs user account becomes a potential vector. For organizations using Gogs as a central Git service for internal development, this could expose source code, dependency information, or embedded secrets. In multi-tenant or compartmentalized setups, it allows lateral movement between network segments that should be isolated.

Affected systems

Gogs versions prior to 0.14.3 are affected. The vulnerability exists in the repository migration functionality, which is present in all default installations. Any deployment of Gogs earlier than 0.14.3 that allows users to create or manage repositories should be considered at risk. Organizations running Gogs in air-gapped or internal-only environments may face higher risk if they have both internal-only repositories and user-controlled migration features enabled.

Exploitability

Exploitation requires a valid Gogs user account (authentication) and user interaction to confirm the migration. An attacker cannot exploit this remotely without credentials. However, the bar for an attacker is low once authenticated: they need only craft a redirect chain using a legitimate public URL and a local redirect service, or social-engineer a Gogs administrator into performing the migration on their behalf. The CVSS vector (PR:L/UI:R) reflects that privilege is required (authenticated user) and user interaction is needed (confirmation of the migration), but the impact is severe due to the circumvention of network-level access controls.

Remediation

Upgrade Gogs to version 0.14.3 or later. This release includes validation of the final repository URL after all redirects have been resolved, preventing SSRF via redirect chains. Organizations should prioritize this patch for any Gogs instances exposed to untrusted users or deployed in network-segmented environments. If immediate patching is not possible, consider disabling the repository migration feature or restricting it to administrators only via access controls.

Patch guidance

Apply the upgrade to Gogs 0.14.3 or later. Verify the patch by checking the version string in the Gogs web interface (typically under Admin > System) or via the git log. After patching, no configuration changes are required; the fix is transparent. Test the migration functionality with a legitimate public repository to ensure normal operation is restored. For containerized deployments, update the base image tag or digest to the patched version and redeploy.

Detection guidance

Monitor Gogs audit logs for repository migration requests, particularly those originating from non-administrator accounts or those targeting unusual hostnames (e.g., localhost, 127.0.0.1, or other internal IP ranges in the initial submission). Network-level detection can flag HTTP requests from the Gogs server to internal addresses during repository operations; however, this is a false positive risk if Gogs legitimately mirrors internal repositories. Log sources include Gogs access logs (looking for POST requests to /repo/migrate or similar endpoints) and the system where git clone is invoked. Check for unexpected repositories appearing in user accounts or external Git hosting services that mirror internal code.

Why prioritize this

Although the CVSS score is 8.7 (HIGH), this vulnerability should be prioritized based on your environment. If your Gogs deployment is in a network-segmented environment with internal repositories that should be confidential, or if you have many non-administrator users with migration privileges, treat this as critical. The attack requires authentication, so it is lower priority than unauthenticated vulnerabilities, but the impact on data confidentiality and the ability to breach network isolation make it serious for most deployments.

Risk score, explained

The CVSS 3.1 score of 8.7 reflects a HIGH severity: the attack vector is network-based, access complexity is low (any authenticated user can attempt it), and the impact is high for confidentiality and integrity (an attacker can read and potentially modify internal repositories). The score accounts for the requirement of prior authentication (PR:L) and user interaction to confirm the migration (UI:R), which slightly reduce the score from 9.0+. Availability is not impacted, hence the A:N component.

Frequently asked questions