Executive brief
Gogs is an open-source self-hosted Git service used by developers to manage source code. A security flaw in its webhook system allows an attacker to trick the server into making unauthorized requests to internal network services that are normally protected from the public internet. This could lead to the exposure of sensitive internal metadata, configuration files, or other private data stored within the organization's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gogs due to improper handling of HTTP redirects during webhook delivery. While Gogs previously implemented checks to prevent users from configuring webhooks that point directly to local CIDR ranges, the application's HTTP client continued to follow redirects. An attacker can provide a URL to a controlled external server that issues a 301 or 302 redirect to an internal IP address (e.g., 169.254.169.254 or 127.0.0.1). This bypasses the initial hostname validation, allowing the attacker to probe internal services or retrieve sensitive cloud metadata. The issue is resolved in version 0.14.3 by implementing a CheckRedirect policy that validates every hop in the redirect chain against blocked local network addresses.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-05-18: other: Fix developed in pull request #8263
- 2026-06-19: advisory: GitHub Security Advisory GHSA-c4v7-xg93-qf8g published
- 2026-06-24: disclosed: CVE-2026-47267 published to NVD