Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and Argo Workflows (CVE-2026-42296/CVE-2026-42295) Targets Managed Kubernetes Clusters

Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and (TL-2026-1230) is a high-severity malware campaign scored CVSS 9.9, first published 2026-07-11 and last reviewed 2026-09-02. It has no confirmed attribution, affects Gogs Gogs self-hosted Git service, references 5 CVEs (CVE-2026-52806, CVE-2026-42296, CVE-2026-42295), maps to 23 MITRE ATT&CK techniques (T1005, T1021, T1036), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1230

Threat ID
TL-2026-1230
Severity
HIGH
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
MALWARE
First published
2026-07-11
Last reviewed
2026-09-02
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, cloud-hosting, managed services provider
Target regions
Global
Detection rules
9
Indicators of compromise
16
Updates
2026-09-02 · revalidated 1× · latest source

Malware and tooling in Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

Malware and tooling: Generic Linux cryptominer, Eldritch DSL, Realm C2

Between June 13-23, 2026, an unattributed threat actor compromised thousands of Linux hosts and large managed Kubernetes clusters by exploiting a critical argument-injection RCE in Gogs (CVE-2026-52806) and authorization-bypass flaws in Argo Workflows (CVE-2026-42296, CVE-2026-42295), deploying the open-source Realm C2 framework and cryptomining payloads, then pivoting laterally to 300+ additional nodes via stolen Kubernetes service account tokens.

How Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and works

Wiz Threat Research documented a mass-exploitation cryptojacking campaign active June 13-23, 2026, that compromised thousands of internet-exposed Linux hosts, with a primary focus on large managed Kubernetes clusters. The attackers relied on two recently disclosed '1-day' vulnerabilities in widely deployed DevOps tooling.

The first is CVE-2026-52806, a CWE-88 argument-injection vulnerability in Gogs (a self-hosted Git service) discovered by Rapid7 Labs on March 16, 2026 and publicly disclosed May 28, 2026 while still unpatched. Gogs' pull-request 'Rebase before merging' feature passes attacker-controlled branch names directly to `git rebase` without a `--` option-terminator. An authenticated user — trivially obtainable because Gogs ships with open registration and unlimited repository creation by default — can create a branch named like `--exec=touch${IFS}/tmp/rce_proof`, open a pull request from it, and trigger arbitrary command execution as the Gogs server process user when the rebase merge is performed. This grants access to every hosted repository (including private repos and embedded secrets), credential material (password hashes, API tokens, SSH keys, 2FA secrets), and a foothold for further pivoting. A fix shipped in Gogs 0.14.3 on June 7, 2026, roughly two weeks before the campaign's compromise window closed, meaning most exploited instances were unpatched at the time of attack.

The second vector targets Argo Workflows, the Kubernetes-native workflow engine. CVE-2026-42296 (CWE-863, Incorrect Authorization, CVSS 3.1 8.1) is an incomplete fix for an earlier advisory (CVE-2026-31892): the original patch blocked `podSpecPatch` under `templateReferencing: Strict/Secure`, but a user with only `create Workflow` permission can still inject `hostNetwork: true`, override `serviceAccountName`, modify `securityContext`, or add `tolerations`/`hostAliases`/`automountServiceAccountToken` fields via a `workflowTemplateRef`, because the validation in `setExecWorkflow` only checks for the presence of `HasPodSpecPatch()`. This lets an attacker with workflow-submission access to an exposed Argo dashboard (a common misconfiguration) escape intended isolation, obtain host network access, assume a more privileged service account, and schedule pods on control-plane nodes. A companion flaw, CVE-2026-42295, causes the Argo workflow executor (4.0.0-4.0.4) to log artifact-repository credentials in plaintext during artifact operations, further aiding credential harvesting. Fixes for the Argo issues landed in 3.7.14 and 4.0.5.

After gaining initial code execution or workflow-submission access, the actor deployed the Realm C2 framework — an open-source, Rust-based adversary-emulation platform (spellshift/realm) built around the Eldritch Starlark-derived scripting DSL, normally used for red-team engagements but repurposed here as attacker infrastructure — alongside cryptocurrency mining payloads to hijack compute resources. Stolen Kubernetes service account tokens were then used to move laterally, reaching over 300 additional Kubernetes nodes beyond the initially compromised hosts. Wiz's report also notes data exfiltration as an observed impact, consistent with the credential and secret exposure enabled by both vulnerability classes. No specific network indicators (IPs, domains, file hashes) were disclosed in the public reporting; defenders are advised to patch Gogs to 0.14.3+ and Argo Workflows to 3.7.14+/4.0.5+ immediately and to audit for the artifact-based indicators described below.

MITRE ATT&CK techniques used in TL-2026-1230

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1570 Lateral Tool Transfer

Defense Evasion

T1036 Masquerading; T1078 Valid Accounts

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1609 Container Administration Command

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking

Discovery

T1526 Cloud Service Discovery; T1613 Container and Resource Discovery

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Privilege Escalation

T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1588 Obtain Capabilities

execution

T1610 Deploy Container

Affected products and versions in Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

  • Gogs — Gogs self-hosted Git service
    Vulnerable versions: 0.14.2; 0.15.0+dev (commit b53d3162); all prior versions supporting Rebase before merging
    Fixed in: 0.14.3
  • Argo Project — Argo Workflows
    Vulnerable versions: <3.7.14; >=4.0.0, <4.0.5
    Fixed in: 3.7.14; 4.0.5

Remediation for Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

Patches

  • Gogs 0.14.3 (released June 7, 2026) — fixes CVE-2026-52806
  • Argo Workflows 3.7.14 / 4.0.5 — fixes CVE-2026-42296
  • Argo Workflows 4.0.5 — fixes CVE-2026-42295
  • Argo Workflows 3.7.11 / 4.0.2 — fixes CVE-2026-28229

Immediate actions

  • Patch Gogs to version 0.14.3 or later to remediate CVE-2026-52806
  • Patch Argo Workflows to 3.7.14 or 4.0.5 or later to remediate CVE-2026-42296 and CVE-2026-42295
  • Restrict or remove public/anonymous access to Argo Workflows dashboards and API endpoints
  • Disable open registration (DISABLE_REGISTRATION=true) and set MAX_CREATION_LIMIT on Gogs instances that cannot be patched immediately
  • Audit Gogs server logs for the error pattern '[E] ...merge: git checkout '--exec=<...>': exit status 128'
  • Audit Gogs repositories for branch names beginning with '--exec=' or other flag-like strings
  • Rotate Kubernetes service account tokens and API tokens on any potentially exposed Gogs or Argo Workflows instance

Workarounds

  • Disable the 'Rebase before merging' pull-request feature in Gogs until patched
  • Restrict network exposure of Gogs and Argo Workflows web interfaces to trusted internal networks
  • Enforce templateReferencing: Strict/Secure and block additional WorkflowSpec fields (hostNetwork, serviceAccountName, securityContext, tolerations) via admission control (e.g. OPA/Gatekeeper) as compensating control

Longer-term hardening

  • Enforce least-privilege RBAC for Argo Workflows 'create Workflow' permission and WorkflowTemplate references
  • Deploy runtime detection for unexpected cryptominer processes and container escape indicators on Kubernetes nodes
  • Implement network segmentation to prevent lateral movement between Kubernetes clusters via stolen service account tokens
  • Monitor for unauthorized deployment of adversary emulation frameworks (e.g., Realm/Eldritch) in production environments
  • Enable audit logging for artifact repository credential access in Argo Workflows executors

CVEs associated with Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

CVE-2026-52806, CVE-2026-42296, CVE-2026-42295, CVE-2026-31892, CVE-2026-28229

Weaknesses (CWE) in Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

CWE-88, CWE-863

Timeline of Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

  • CISA adds an unrelated, prior Gogs symlink-bypass RCE (CVE-2025-8110) to the KEV catalog after Wiz Research found 700+ compromised internet-facing Gogs instances -- establishing internet-exposed Gogs as an actively-targeted foothold class ahead of this campaign, per the source Wiz article.
  • Argo Workflows discloses CVE-2026-28229 (GHSA-56px-hm34-xqj5): unauthenticated broken access control exposing WorkflowTemplate/ClusterWorkflowTemplate content and embedded Secrets; fixed in 3.7.11/4.0.2.
  • Rapid7 Labs discovers the Gogs argument-injection RCE vulnerability (later CVE-2026-52806)
  • Rapid7 publicly discloses the unfixed Gogs RCE vulnerability
  • Gogs 0.14.3 released, fixing CVE-2026-52806 via proper argument sanitization in the merge function (PR #8301)
  • Mass-exploitation cryptojacking campaign against Gogs and Argo Workflows begins, compromising thousands of Linux hosts
  • Active compromise window closes; lateral movement via stolen Kubernetes service account tokens reaches 300+ additional nodes
  • CVE-2026-52806 officially published in NVD; GHSA-3775-99mw-8rp4 advisory for Argo Workflows CVE-2026-42296 published
  • Wiz Threat Research publishes incident report on the cryptojacking campaign targeting Kubernetes clusters
  • Wiz incident report receives its last editorial update

Update history for TL-2026-1230

Sources cited for Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

Threats related to Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and

Detection coverage for TL-2026-1230

As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1230 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats