Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and Argo Workflows (CVE-2026-42296/CVE-2026-42295) Targets Managed Kubernetes Clusters
Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and (TL-2026-1230) is a high-severity malware campaign scored CVSS 9.9, first published 2026-07-11 and last reviewed 2026-09-02. It has no confirmed attribution, affects Gogs Gogs self-hosted Git service, references 5 CVEs (CVE-2026-52806, CVE-2026-42296, CVE-2026-42295), maps to 23 MITRE ATT&CK techniques (T1005, T1021, T1036), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1230
- Threat ID
- TL-2026-1230
- Severity
- HIGH
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-11
- Last reviewed
- 2026-09-02
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud-hosting, managed services provider
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
- Updates
- 2026-09-02 · revalidated 1× · latest source
Malware and tooling in Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
Malware and tooling: Generic Linux cryptominer, Eldritch DSL, Realm C2
Between June 13-23, 2026, an unattributed threat actor compromised thousands of Linux hosts and large managed Kubernetes clusters by exploiting a critical argument-injection RCE in Gogs (CVE-2026-52806) and authorization-bypass flaws in Argo Workflows (CVE-2026-42296, CVE-2026-42295), deploying the open-source Realm C2 framework and cryptomining payloads, then pivoting laterally to 300+ additional nodes via stolen Kubernetes service account tokens.
How Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and works
Wiz Threat Research documented a mass-exploitation cryptojacking campaign active June 13-23, 2026, that compromised thousands of internet-exposed Linux hosts, with a primary focus on large managed Kubernetes clusters. The attackers relied on two recently disclosed '1-day' vulnerabilities in widely deployed DevOps tooling.
The first is CVE-2026-52806, a CWE-88 argument-injection vulnerability in Gogs (a self-hosted Git service) discovered by Rapid7 Labs on March 16, 2026 and publicly disclosed May 28, 2026 while still unpatched. Gogs' pull-request 'Rebase before merging' feature passes attacker-controlled branch names directly to `git rebase` without a `--` option-terminator. An authenticated user — trivially obtainable because Gogs ships with open registration and unlimited repository creation by default — can create a branch named like `--exec=touch${IFS}/tmp/rce_proof`, open a pull request from it, and trigger arbitrary command execution as the Gogs server process user when the rebase merge is performed. This grants access to every hosted repository (including private repos and embedded secrets), credential material (password hashes, API tokens, SSH keys, 2FA secrets), and a foothold for further pivoting. A fix shipped in Gogs 0.14.3 on June 7, 2026, roughly two weeks before the campaign's compromise window closed, meaning most exploited instances were unpatched at the time of attack.
The second vector targets Argo Workflows, the Kubernetes-native workflow engine. CVE-2026-42296 (CWE-863, Incorrect Authorization, CVSS 3.1 8.1) is an incomplete fix for an earlier advisory (CVE-2026-31892): the original patch blocked `podSpecPatch` under `templateReferencing: Strict/Secure`, but a user with only `create Workflow` permission can still inject `hostNetwork: true`, override `serviceAccountName`, modify `securityContext`, or add `tolerations`/`hostAliases`/`automountServiceAccountToken` fields via a `workflowTemplateRef`, because the validation in `setExecWorkflow` only checks for the presence of `HasPodSpecPatch()`. This lets an attacker with workflow-submission access to an exposed Argo dashboard (a common misconfiguration) escape intended isolation, obtain host network access, assume a more privileged service account, and schedule pods on control-plane nodes. A companion flaw, CVE-2026-42295, causes the Argo workflow executor (4.0.0-4.0.4) to log artifact-repository credentials in plaintext during artifact operations, further aiding credential harvesting. Fixes for the Argo issues landed in 3.7.14 and 4.0.5.
After gaining initial code execution or workflow-submission access, the actor deployed the Realm C2 framework — an open-source, Rust-based adversary-emulation platform (spellshift/realm) built around the Eldritch Starlark-derived scripting DSL, normally used for red-team engagements but repurposed here as attacker infrastructure — alongside cryptocurrency mining payloads to hijack compute resources. Stolen Kubernetes service account tokens were then used to move laterally, reaching over 300 additional Kubernetes nodes beyond the initially compromised hosts. Wiz's report also notes data exfiltration as an observed impact, consistent with the credential and secret exposure enabled by both vulnerability classes. No specific network indicators (IPs, domains, file hashes) were disclosed in the public reporting; defenders are advised to patch Gogs to 0.14.3+ and Argo Workflows to 3.7.14+/4.0.5+ immediately and to audit for the artifact-based indicators described below.
MITRE ATT&CK techniques used in TL-2026-1230
Collection
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1036 Masquerading; T1078 Valid Accounts
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1609 Container Administration Command
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Persistence
T1098 Account Manipulation; T1136 Create Account
Initial Access
T1190 Exploit Public-Facing Application
Impact
Discovery
T1526 Cloud Service Discovery; T1613 Container and Resource Discovery
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Privilege Escalation
T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
execution
Affected products and versions in Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
- Gogs — Gogs self-hosted Git service
Vulnerable versions: 0.14.2; 0.15.0+dev (commit b53d3162); all prior versions supporting Rebase before merging
Fixed in: 0.14.3 - Argo Project — Argo Workflows
Vulnerable versions: <3.7.14; >=4.0.0, <4.0.5
Fixed in: 3.7.14; 4.0.5
Remediation for Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
Patches
- Gogs 0.14.3 (released June 7, 2026) — fixes CVE-2026-52806
- Argo Workflows 3.7.14 / 4.0.5 — fixes CVE-2026-42296
- Argo Workflows 4.0.5 — fixes CVE-2026-42295
- Argo Workflows 3.7.11 / 4.0.2 — fixes CVE-2026-28229
Immediate actions
- Patch Gogs to version 0.14.3 or later to remediate CVE-2026-52806
- Patch Argo Workflows to 3.7.14 or 4.0.5 or later to remediate CVE-2026-42296 and CVE-2026-42295
- Restrict or remove public/anonymous access to Argo Workflows dashboards and API endpoints
- Disable open registration (DISABLE_REGISTRATION=true) and set MAX_CREATION_LIMIT on Gogs instances that cannot be patched immediately
- Audit Gogs server logs for the error pattern '[E] ...merge: git checkout '--exec=<...>': exit status 128'
- Audit Gogs repositories for branch names beginning with '--exec=' or other flag-like strings
- Rotate Kubernetes service account tokens and API tokens on any potentially exposed Gogs or Argo Workflows instance
Workarounds
- Disable the 'Rebase before merging' pull-request feature in Gogs until patched
- Restrict network exposure of Gogs and Argo Workflows web interfaces to trusted internal networks
- Enforce templateReferencing: Strict/Secure and block additional WorkflowSpec fields (hostNetwork, serviceAccountName, securityContext, tolerations) via admission control (e.g. OPA/Gatekeeper) as compensating control
Longer-term hardening
- Enforce least-privilege RBAC for Argo Workflows 'create Workflow' permission and WorkflowTemplate references
- Deploy runtime detection for unexpected cryptominer processes and container escape indicators on Kubernetes nodes
- Implement network segmentation to prevent lateral movement between Kubernetes clusters via stolen service account tokens
- Monitor for unauthorized deployment of adversary emulation frameworks (e.g., Realm/Eldritch) in production environments
- Enable audit logging for artifact repository credential access in Argo Workflows executors
CVEs associated with Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
CVE-2026-52806, CVE-2026-42296, CVE-2026-42295, CVE-2026-31892, CVE-2026-28229
Weaknesses (CWE) in Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
CWE-88, CWE-863
Timeline of Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
- CISA adds an unrelated, prior Gogs symlink-bypass RCE (CVE-2025-8110) to the KEV catalog after Wiz Research found 700+ compromised internet-facing Gogs instances -- establishing internet-exposed Gogs as an actively-targeted foothold class ahead of this campaign, per the source Wiz article.
- Argo Workflows discloses CVE-2026-28229 (GHSA-56px-hm34-xqj5): unauthenticated broken access control exposing WorkflowTemplate/ClusterWorkflowTemplate content and embedded Secrets; fixed in 3.7.11/4.0.2.
- Rapid7 Labs discovers the Gogs argument-injection RCE vulnerability (later CVE-2026-52806)
- Rapid7 publicly discloses the unfixed Gogs RCE vulnerability
- Gogs 0.14.3 released, fixing CVE-2026-52806 via proper argument sanitization in the merge function (PR #8301)
- Mass-exploitation cryptojacking campaign against Gogs and Argo Workflows begins, compromising thousands of Linux hosts
- Active compromise window closes; lateral movement via stolen Kubernetes service account tokens reaches 300+ additional nodes
- CVE-2026-52806 officially published in NVD; GHSA-3775-99mw-8rp4 advisory for Argo Workflows CVE-2026-42296 published
- Wiz Threat Research publishes incident report on the cryptojacking campaign targeting Kubernetes clusters
- Wiz incident report receives its last editorial update
Update history for TL-2026-1230
- 2026-09-02 — Cryptojacking Campaign Targeting Kubernetes Clusters via Argo Workflows and Gogs Exploitation (Realm C2): What changed No field escalations -- severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution_confidence (LOW) all match the existing record. New indicators (1) 1 new behavioral indicator: the merge_style=rebase_before_mer
Sources cited for Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
- Cryptojacking Campaign Targeting K8s Clusters
- Authenticated RCE via Argument Injection in Gogs (NOT FIXED)
- New Gogs zero-day flaw lets hackers get remote code execution
- Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
- Gogs patches critical zero-day enabling remote code execution
- Gogs Zero-Day Exposes Servers to Remote Code Execution
- Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects
- Incomplete fix for CVE-2026-31892: templateReferencing Strict/Secure bypass
- CVE-2026-42296: Argo Workflows Auth Bypass Vulnerability
- CVE-2026-42295: Argo Workflows: Exposure of artifact repository credentials
- Realm: cross platform Red Team engagement platform
Threats related to Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and
- P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)
- JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441)
- Threat Actors Mass-Probe Gitea Docker Deployments for CVE-2026-20896 Authentication Bypass Amid Exploitarium Zero-Day Leak Wave
- Gogs Authenticated RCE via Argument Injection in git rebase --exec (Unpatched, CVSSv4 9.4, GHSA-qf6p-p7ww-cwr9)
- NATS-as-C2: KeyHunter Distributed Worker Botnet Harvests Cloud Credentials and AI API Keys via Langflow RCE (CVE-2026-33017)
- NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool Access
Detection coverage for TL-2026-1230
As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1230 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.