CVE-2026-55060GoCD is vulnerable to authorization bypass via support process list API
Updated under an hour ago ()
Does this affect you?
It affects gocd. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.
- CVSS
- 3.7 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 21, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
gocd gocd gocd:gocd (from the name) | from 13.1.0, < 26.1.0 | CNA record |
References
- https://github.com/gocd/gocd/security/advisories/GHSA-vqjf-7pf8-hgwrx-refsource-confirm
- https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8x-refsource-misc
- https://github.com/gocd/gocd/releases/tag/26.1.0x-refsource-misc
- https://www.gocd.org/releases/#26-1-0x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.