# Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and Argo Workflows (CVE-2026-42296/CVE-2026-42295) Targets Managed Kubernetes Clusters

> Between June 13-23, 2026, an unattributed threat actor compromised thousands of Linux hosts and large managed Kubernetes clusters by exploiting a critical argument-injection RCE in Gogs (CVE-2026-52806) and authorization-bypass flaws in Argo Workflows (CVE-2026-42296, CVE-2026-42295), deploying the open-source Realm C2 framework and cryptomining payloads, then pivoting laterally to 300+ additional nodes via stolen Kubernetes service account tokens.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-09-02T13:54:39.270Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1230
- **ID:** TL-2026-1230
- **Severity:** HIGH (CVSS 9.9)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-52806, CVE-2026-42296, CVE-2026-42295, CVE-2026-31892, CVE-2026-28229

## Description

Wiz Threat Research documented a mass-exploitation cryptojacking campaign active June 13-23, 2026, that compromised thousands of internet-exposed Linux hosts, with a primary focus on large managed Kubernetes clusters. The attackers relied on two recently disclosed '1-day' vulnerabilities in widely deployed DevOps tooling.

The first is CVE-2026-52806, a CWE-88 argument-injection vulnerability in Gogs (a self-hosted Git service) discovered by Rapid7 Labs on March 16, 2026 and publicly disclosed May 28, 2026 while still unpatched. Gogs' pull-request 'Rebase before merging' feature passes attacker-controlled branch names directly to `git rebase` without a `--` option-terminator. An authenticated user — trivially obtainable because Gogs ships with open registration and unlimited repository creation by default — can create a branch named like `--exec=touch${IFS}/tmp/rce_proof`, open a pull request from it, and trigger arbitrary command execution as the Gogs server process user when the rebase merge is performed. This grants access to every hosted repository (including private repos and embedded secrets), credential material (password hashes, API tokens, SSH keys, 2FA secrets), and a foothold for further pivoting. A fix shipped in Gogs 0.14.3 on June 7, 2026, roughly two weeks before the campaign's compromise window closed, meaning most exploited instances were unpatched at the time of attack.

The second vector targets Argo Workflows, the Kubernetes-native workflow engine. CVE-2026-42296 (CWE-863, Incorrect Authorization, CVSS 3.1 8.1) is an incomplete fix for an earlier advisory (CVE-2026-31892): the original patch blocked `podSpecPatch` under `templateReferencing: Strict/Secure`, but a user with only `create Workflow` permission can still inject `hostNetwork: true`, override `serviceAccountName`, modify `securityContext`, or add `tolerations`/`hostAliases`/`automountServiceAccountToken` fields via a `workflowTemplateRef`, because the validation in `setExecWorkflow` only checks for the presence of `HasPodSpecPatch()`. This lets an attacker with workflow-submission access to an exposed Argo dashboard (a common misconfiguration) escape intended isolation, obtain host network access, assume a more privileged service account, and schedule pods on control-plane nodes. A companion flaw, CVE-2026-42295, causes the Argo workflow executor (4.0.0-4.0.4) to log artifact-repository credentials in plaintext during artifact operations, further aiding credential harvesting. Fixes for the Argo issues landed in 3.7.14 and 4.0.5.

After gaining initial code execution or workflow-submission access, the actor deployed the Realm C2 framework — an open-source, Rust-based adversary-emulation platform (spellshift/realm) built around the Eldritch Starlark-derived scripting DSL, normally used for red-team engagements but repurposed here as attacker infrastructure — alongside cryptocurrency mining payloads to hijack compute resources. Stolen Kubernetes service account tokens were then used to move laterally, reaching over 300 additional Kubernetes nodes beyond the initially compromised hosts. Wiz's report also notes data exfiltration as an observed impact, consistent with the credential and secret exposure enabled by both vulnerability classes. No specific network indicators (IPs, domains, file hashes) were disclosed in the public reporting; defenders are advised to patch Gogs to 0.14.3+ and Argo Workflows to 3.7.14+/4.0.5+ immediately and to audit for the artifact-based indicators described below.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1609 Container Administration Command
- T1098 Account Manipulation
- T1136 Create Account
- T1611 Escape to Host
- T1548 Abuse Elevation Control Mechanism
- T1610 Deploy Container
- T1550 Use Alternate Authentication Material
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1613 Container and Resource Discovery
- T1526 Cloud Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1588 Obtain Capabilities
- T1078 Valid Accounts

## Sources

- [Cryptojacking Campaign Targeting K8s Clusters](https://threats.wiz.io/all-incidents/cryptojacking-campaign-targeting-k8s-clusters)
- [Authenticated RCE via Argument Injection in Gogs (NOT FIXED)](https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/)
- [New Gogs zero-day flaw lets hackers get remote code execution](https://www.bleepingcomputer.com/news/security/new-gogs-zero-day-flaw-lets-hackers-get-remote-code-execution/)
- [Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html)
- [Gogs patches critical zero-day enabling remote code execution](https://www.bleepingcomputer.com/news/security/gogs-patches-critical-zero-day-enabling-remote-code-execution/)
- [Gogs Zero-Day Exposes Servers to Remote Code Execution](https://www.securityweek.com/gogs-zero-day-exposes-servers-to-remote-code-execution/)
- [Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects](https://www.infoworld.com/article/4178406/lack-of-response-to-critical-vulnerability-in-gogs-is-a-reminder-of-the-limits-of-open-source-projects.html)
- [Incomplete fix for CVE-2026-31892: templateReferencing Strict/Secure bypass](https://github.com/argoproj/argo-workflows/security/advisories/GHSA-3775-99mw-8rp4)
- [CVE-2026-42296: Argo Workflows Auth Bypass Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-42296/)
- [CVE-2026-42295: Argo Workflows: Exposure of artifact repository credentials](https://cve.imfht.com/detail/CVE-2026-42295?lang=en)
- [Realm: cross platform Red Team engagement platform](https://github.com/spellshift/realm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1230