A critical remote code execution vulnerability (CVSS 9.4) has been discovered in Gogs, a popular open-source self-hosted Git service, allowing any authenticated user to fully compromise servers, steal credentials, or tamper with code repositories. Rapid7 researcher Jonah Burgess reported the flaw to Gogs maintainers in March 2026, but despite initial acknowledgement, they have not responded since and no patch exists, while a public Metasploit exploit module has now been released. Users are advised to disable open registration, restrict repository creation, and turn off the "Rebase before merging" setting as interim mitigations until an official fix is available.
