CVE-2026-26194: Gogs release-deletion argument injection
The short version: Gogs — the self-hosted Git service — mishandles a user-controlled tag name when deleting a release (CVE-2026-26194). Because the tag isn't passed to Git with the right separator, an authenticated user can inject Git options and disrupt the process. It's fixed in Gogs 0.14.2. If you self-host an affected version, upgrade.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — post-auth, needs interaction, no data disclosure |
| CVSS v3.1 (NVD) | 7.3 — High · AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H |
| EPSS | ~0.43% · 35th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in the wild |
| Vulnerability type | CWE-88 argument injection (via crafted tag name) → integrity / availability impact |
| Requires authenticated session? | Yes — a low-privileged user, plus user interaction |
| Affected | Gogs before 0.14.2 |
| Fixed in | 0.14.2 |
What you need to know
When a Gogs release is deleted, the associated tag name — which a user controls — is passed to Git. Without the correct argument separator, Git interprets parts of that tag name as options rather than data, so an attacker can inject Git options that "mess with the process." The impact here is to integrity and availability (the CVSS vector shows no confidentiality impact), and it requires an authenticated, interacting user.
Two things to keep in perspective:
- It's not a clean data-disclosure or unauthenticated RCE. The scored impact is integrity/availability, and exploitation requires both privileges and user interaction.
- The auth bar can still be low. On instances that allow self-registration, "authenticated" is easy to reach — which is why keeping current matters even for a lower-severity flaw.
How serious we see it
Moderate.
The NVD assigns a High base score of 7.3, but the practical picture is calmer than that number alone: it needs an authenticated session and user interaction, it doesn't disclose data, and there's no evidence of exploitation in the wild (EPSS is low). We rate it Moderate — worth fixing on a normal cadence, not a fire drill. The reassuring part is that a single upgrade to 0.14.2 closes it.
Recommendations
- Patch on your normal cadence. Upgrade to Gogs 0.14.2 or later.
- Reduce the auth bar. Disable open self-registration on internet-facing instances.
- Restrict exposure. Limit who can reach the Gogs instance from the internet.
- Confirm your exposure first. Verify whether you run an affected Gogs version.
How BreachRisk sees it
BreachRisk discovers internet-facing Gogs instances in your external footprint, fingerprints the version, and flags exposure tied to this CVE. Because reaching the flaw requires an authenticated, interacting user, it isn't something we safely exploit — we detect and flag the affected version so it lands on your radar at the right priority.
That outside-in view keeps even lower-severity issues visible, so nothing quietly ages into a bigger problem.