CVE-2026-26196: Gogs Information Disclosure Vulnerability

CVE-2026-26196 Overview

CVE-2026-26196 is an Information Leakage vulnerability affecting Gogs, an open source self-hosted Git service. Prior to version 0.14.2, the Gogs API improperly accepts authentication tokens via URL query parameters such as token and access_token. This insecure practice can result in credential leakage through server logs, browser history, and HTTP referrer headers.

Critical Impact

Authentication tokens passed in URL parameters can be inadvertently exposed in server access logs, browser history, and Referer headers when navigating to external sites, potentially allowing attackers to hijack user sessions or gain unauthorized access to Git repositories.

Affected Products

• Gogs versions prior to 0.14.2
• Gogs API endpoints accepting token or access_token query parameters

Discovery Timeline

• 2026-03-05 - CVE-2026-26196 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26196

Vulnerability Analysis

This vulnerability falls under CWE-598 (Use of GET Request Method With Sensitive Query Strings), which describes the insecure practice of transmitting sensitive information via URL query parameters. When authentication tokens are passed in URLs rather than HTTP headers, they become vulnerable to exposure through multiple channels.

The core issue is that URLs, including their query parameters, are frequently logged and cached in locations that are not designed to securely store credentials. Server access logs typically record the full request URL, browser history preserves visited URLs, and the HTTP Referer header transmits the previous page's URL (including query parameters) to external sites when a user clicks outbound links.

Root Cause

The root cause lies in the Gogs API authentication handler (internal/context/auth.go) which was designed to accept access tokens via both URL query parameters (token and access_token) and the HTTP Authorization header. While header-based authentication is secure, the query parameter method creates an inherent risk of token leakage since URLs are not treated as confidential by browsers, proxies, and web servers.

Attack Vector

An attacker could exploit this vulnerability through several scenarios:

1. Log File Access: If an attacker gains read access to server logs or reverse proxy logs, they can harvest authentication tokens from logged URLs
2. Browser History Mining: Malware or shoulder surfing could expose tokens stored in browser history
3. Referer Header Leakage: When users click external links from Gogs pages, the Referer header sent to the external site may contain the authentication token
4. Shared Workstations: Tokens remain in browser history on shared or public computers

// Security patch in internal/context/auth.go
// Source: https://github.com/gogs/gogs/commit/295bfba72993c372e7b338438947d8e1a6bed8fd

 
 	// Check access token.
 	if isAPIPath(c.Req.URL.Path) {
-		tokenSHA := c.Query("token")
-		if len(tokenSHA) <= 0 {
-			tokenSHA = c.Query("access_token")
-		}
-		if tokenSHA == "" {
-			// Well, check with header again.
-			auHead := c.Req.Header.Get("Authorization")
-			if len(auHead) > 0 {
-				auths := strings.Fields(auHead)
-				if len(auths) == 2 && auths[0] == "token" {
-					tokenSHA = auths[1]
-				}
+		var tokenSHA string
+		auHead := c.Req.Header.Get("Authorization")
+		if auHead != "" {
+			auths := strings.Fields(auHead)
+			if len(auths) == 2 && auths[0] == "token" {
+				tokenSHA = auths[1]
 			}
 		}

Detection Methods for CVE-2026-26196

Indicators of Compromise

• Review web server and reverse proxy access logs for API requests containing token= or access_token= query parameters
• Check for unusual API activity patterns that may indicate token reuse by unauthorized parties
• Monitor for authentication from unexpected IP addresses or geolocations using tokens previously exposed in logs

Detection Strategies

• Implement log analysis rules to detect and alert on URLs containing authentication tokens in query parameters
• Deploy network monitoring to identify Gogs API requests using URL-based token authentication
• Audit browser history and proxy logs for exposed tokens if a compromise is suspected

Monitoring Recommendations

• Enable detailed logging for the Gogs application and monitor for authentication anomalies
• Implement Security Information and Event Management (SIEM) rules to flag requests with sensitive data in URLs
• Consider deploying a Web Application Firewall (WAF) to detect and block requests with tokens in query strings

How to Mitigate CVE-2026-26196

Immediate Actions Required

• Upgrade Gogs to version 0.14.2 or later immediately
• Rotate all existing personal access tokens after upgrading to invalidate any potentially leaked credentials
• Update any automation scripts or CI/CD pipelines to use header-based authentication instead of URL query parameters
• Review server access logs and purge any entries containing exposed tokens

Patch Information

The vulnerability has been patched in Gogs version 0.14.2. The fix removes support for token-based authentication via URL query parameters, requiring all API clients to use the Authorization HTTP header with the format token {YOUR_ACCESS_TOKEN}. For detailed information about the patch, see the GitHub Security Advisory GHSA-x9p5-w45c-7ffc and the related commit.

Workarounds

• If immediate upgrade is not possible, configure a reverse proxy to strip token and access_token query parameters from incoming requests
• Implement log sanitization to redact tokens from URLs before they are written to log files
• Educate users to avoid using URL-based token authentication and switch to header-based methods

# Example: Update API calls to use header-based authentication
# Before (vulnerable):
curl "https://gogs.example.com/api/v1/users?token=YOUR_TOKEN"

# After (secure):
curl -H "Authorization: token YOUR_TOKEN" "https://gogs.example.com/api/v1/users"