CVE-2026-53552: Goploy Namespace Bypass RCE Vulnerability

CVE-2026-53552 Overview

CVE-2026-53552 is an Insecure Direct Object Reference (IDOR) vulnerability in Goploy, an open-source automation deployment system. The flaw affects versions 1.17.5 and prior. Handlers in cmd/server/api/project/handler.go accept project or project-file identifiers from the JSON request body without verifying namespace ownership. An authenticated user with the manager role, or any role granting FileSync or EditProject permissions, can read, write, or delete files across any project in the installation. The attacker can also rewrite a foreign project's git remote URL, which escalates to remote code execution on the next deploy.

Critical Impact

Any authenticated tenant user can pivot to code execution across every project on the Goploy install by submitting foreign resource IDs.

Affected Products

• Goploy versions 1.17.5 and prior
• cmd/server/api/project/handler.go handlers: Project.AddFile, Project.EditFile, Project.RemoveFile, Project.Edit
• model.ProjectFile.GetData and model.Project.GetData query paths

Discovery Timeline

• 2026-08-31 - CVE-2026-53552 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-53552

Vulnerability Analysis

Goploy segments tenants using namespaces, and role permissions such as FileSync and EditProject are meant to apply only inside the caller's namespace. The affected handlers break that boundary. Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit read a project or project-file row identifier directly from the JSON body and pass it to model.ProjectFile.GetData or model.Project.GetData. Those queries filter only by primary key, never by namespace. The server therefore trusts the client-supplied ID and performs the action against whatever row matches.

The consequences fall into two classes. First, an attacker gains arbitrary file read, write, and delete against any project on the install, which alone exposes deployment scripts and secrets. Second, Project.Edit allows rewriting the git remote URL of a foreign project. On the next deploy, Goploy invokes git remote set-url on the working tree, then fetches and executes deployment steps from the attacker-controlled repository. This turns the IDOR into remote code execution on the deployment host. This weakness is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Root Cause

Authorization checks are missing at the model layer. GetData methods filter records by row identifier without joining the caller's namespace ID from the session context. The handler layer likewise does not validate that the requested resource belongs to the caller's namespace before invoking the model.

Attack Vector

Exploitation requires an authenticated Goploy account with FileSync or EditProject permissions in any namespace, which the manager role provides by default. The attacker submits a JSON request to one of the vulnerable endpoints and substitutes a foreign project or project-file ID. To achieve code execution, the attacker calls Project.Edit with a target project ID and a hostile git remote URL. When an operator triggers the next deploy, Goploy fetches and runs code from the attacker's repository.

See the GitHub Security Advisory GHSA-26rh-24rg-j3vv for the vendor-published technical details.

Detection Methods for CVE-2026-53552

Indicators of Compromise

• Unexpected changes to git remote URLs in project configuration tables or on-disk working trees.
• Deploy logs showing git remote set-url followed by fetches from unfamiliar external repositories.
• Project file modifications performed by accounts that do not own the target project's namespace.
• Outbound network connections from the Goploy deploy host to previously unseen git hosting endpoints.

Detection Strategies

• Audit Goploy API access logs for requests to AddFile, EditFile, RemoveFile, and Edit endpoints where the acting user's namespace does not match the target project's namespace.
• Correlate deploy events with recent Project.Edit calls to detect remote-URL rewrites immediately preceding a deploy.
• Monitor the Goploy database for cross-namespace mutations by joining project row updates against the acting session's namespace ID.

Monitoring Recommendations

• Enable verbose HTTP request logging on the Goploy server and forward it to a centralized log platform for retention and query.
• Alert on any modification of the url field in the projects table outside of expected change windows.
• Track deploy job stdout for git remote set-url invocations that reference domains outside an approved allowlist.

How to Mitigate CVE-2026-53552

Immediate Actions Required

• Restrict Goploy access to trusted operators until a patched release is available; remove FileSync and EditProject permissions from non-administrative roles.
• Place the Goploy web interface behind a VPN or IP allowlist to limit the pool of authenticated users who could abuse the flaw.
• Audit all projects for unexpected git remote URLs and revert any that do not match the intended source repository before running further deploys.
• Rotate credentials, deploy keys, and secrets stored in project files, since cross-namespace read access may have exposed them.

Patch Information

At the time of publication, the maintainers have not released a patched version of Goploy. Track the GitHub Security Advisory GHSA-26rh-24rg-j3vv for updates and apply the fix as soon as it is published.

Workarounds

• Reduce the set of users assigned the manager role, and remove FileSync or EditProject permissions from custom roles until patched.
• Require change-control review before any deploy runs, so an attacker-planted git remote cannot execute without human inspection.
• Isolate the Goploy deploy host on a segmented network with egress restrictions that block outbound git traffic to unapproved destinations.
• Enable multi-factor authentication on Goploy accounts to raise the cost of account compromise that would otherwise enable this attack.

# Configuration example: restrict egress from the Goploy deploy host to approved git hosts only
iptables -A OUTPUT -p tcp -d github.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -d gitlab.internal.example.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -p tcp --dport 22 -j REJECT