8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47267

CVE-2026-47267: Gogs: SSRF in webhook deliveries

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47267

CVE-2026-47267:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.14.2	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the webhook delivery mechanism of Gogs. The core of the issue lies in the HookTask.deliver function located in internal/database/webhook.go. This function constructs and sends an HTTP POST request for webhook events. The analysis of the patch 199cf4fd5bbe40b92f6dc8d649e241fd7a8d0018 reveals that the underlying HTTP client was following redirects by default. This allowed an attacker to specify a webhook URL that redirects to an internal or restricted network address, causing the Gogs server to make a request to that address (SSRF). The fix involves adding a CheckRedirect function to the HTTP request settings within HookTask.deliver, which explicitly returns an error on any attempt to redirect, thus preventing the SSRF. The changes in internal/httplib/httplib.go were made to support this new CheckRedirect setting. Therefore, the HookTask.deliver function is the primary vulnerable function, as it's the entry point for the vulnerable action.

Vulnerable functions

HookTask.deliver

internal/database/webhook.go

The `deliver` function in `HookTask` is responsible for sending webhook payloads. Before the patch, the HTTP client used to send the request would automatically follow HTTP redirects. An attacker could configure a webhook to point to a server they control, which would then issue a redirect (e.g., a 301 or 302) to an internal IP address. The Gogs server would then make a request to that internal address, leading to a Server-Side Request Forgery (SSRF) vulnerability. The patch mitigates this by adding a `CheckRedirect` policy to the HTTP client that explicitly disallows any redirects.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.