Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

GoCD allows internal users to see hidden process details

CVE-2026-55060 · published 28 days ago
Summary

Versions of GoCD from 13.1.0 through 26.1.0 let any signed‑in user call a support API that should be admin‑only. By using that call, a user can view command‑line arguments and internal paths for source‑control jobs they normally cannot see. Upgrade to version 26.1.0 or later to restore proper access controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gocd gocd >= 13.1.0, < 26.1.0
Original advisory text
GoCD is vulnerable to authorization bypass via support process list API
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-55060 · NVD
CVE-2026-55060 · MITRE
CVE-2026-55060 · OSV
GHSA-vqjf-7pf8-hgwr · GHSA
Track software like this
Free during beta