Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and Argo Workflows (CVE-2026-42296/CVE-2026-42295) Targets Managed Kubernetes Clusters — Threadlinqs Intelligence
As of 2026-07-11, Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and Argo Workflows (CVE-2026-42296/CVE-2026-42295) Targets Managed Kubernetes Clusters is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-1230 · Severity: HIGH · CVSS: 9.9 · Status: ACTIVE · Category: MALWARE
Between June 13-23, 2026, an unattributed threat actor compromised thousands of Linux hosts and large managed Kubernetes clusters by exploiting a critical argument-injection RCE in Gogs
Wiz Threat Research documented a mass-exploitation cryptojacking campaign active June 13-23, 2026, that compromised thousands of internet-exposed Linux hosts, with a primary focus on large managed Kubernetes clusters. The attackers relied on two recently disclosed '1-day' vulnerabilities in widely deployed DevOps tooling.
The first is CVE-2026-52806, a CWE-88 argument-injection vulnerability in Gogs (a self-hosted Git service) discovered by Rapid7 Labs on March 16, 2026 and publicly disclosed May 28, 2026 while still unpatched. Gogs' pull-request 'Rebase before merging' feature passes attacker-controlled branch names directly to `git rebase` without a `--` option-terminator. An authenticated user — trivially obtainable because Gogs ships with open registration and unlimited repository creation by default — can create a branch named like `--exec=touch${IFS}/tmp/rce_proof`, open a pull request from it, and trigger arbitrary command execution as the Gogs server process user when the rebase merge is performed. This grants access to every hosted repository (including private repos and embedded secrets), credential material (password hashes, API tokens, SSH keys, 2FA secrets), and a foothold for further pivoting. A fix shipped in Gogs 0.14.3 on June 7, 2026, roughly two weeks before the campaign's compromise window closed, meaning most exploited instances were unpatched at the time of attack.
The second vector targets Argo Workflows, the Kubernetes-native workflow engine. CVE-2026-42296 (CWE-863, Incorrect Authorization, CVSS 3.1 8.1) is an incomplete fix for an earlier advisory (CVE-2026-31892): the original patch blocked `podSpecPatch` under `templateReferencing: Strict/Secure`, but a user with only `create Workflow` permission can still inject `hostNetwork: true`, override `serviceAccountName`, modify `securityContext`, or add `tolerations`/`hostAliases`/`automountServiceAccountToken` fields via a `workflowTemplateRef`, because the validation in `setExecWorkflow` only checks for the presence of `HasPodSpecPatch()`. This lets an attacker with workflow-submission access to an exposed Argo dashboard (a common misconfiguration) escape intended isolation, obtain host network access, assume a more privileged service account, and schedule pods on control-plane nodes. A companion flaw, CVE-2026-42295, causes the Argo workflow executor (4.0.0-4.0.4) to log artifact-repository credentials in plaintext during artifact operations, further aiding credential harvesting. Fixes for the Argo issues landed in 3.7.14 and 4.0.5.
After gaining initial code execution or workflow-submission access, the actor deployed the Realm C2 framework — an open-source, Rust-based adversary-emulation platform (spellshift/realm) built around the Eldritch Starlark-derived scripting DSL, normally used for red-team engagements but repurposed here as attacker infrastructure — alongside cryptocurrency mining payloads to hijack compute resources. Stolen Kubernetes service account tokens were then used to move laterally, reaching over 300 additional Kubernetes nodes beyond the initially compromised hosts. Wiz's report also notes data exfiltration as an observed impact, consistent with the credential and secret exposure enabled by both vulnerability classes. No specific network indicators (IPs, domains, file hashes) were disclosed in the public reporting; defenders are advised to patch Gogs to 0.14.3+ and Argo Workflows to 3.7.14+/4.0.5+ immediately and to audit for the artifact-based indicators described below.
Weaknesses (CWE)
CWE-88, CWE-863
Target sectors: technology, cloud-hosting, managed services provider
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2026-52806, CVE-2026-42296, CVE-2026-42295, CVE-2026-31892, CVE-2026-28229, T1190, T1059, T1609, T1098, T1136, T1611, T1548, T1610, T1550, T1036