Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

Woodpecker lets push users run pods as any ServiceAccount

CVE-2026-61549 · published 26 days ago
Summary

In Woodpecker versions before 3.16.0, anyone with permission to push code to a repository could set the service account name for the Kubernetes pod it creates. This lets them run the pod with the permissions of any ServiceAccount in the cluster, potentially exposing database passwords, API keys, and other secrets. Upgrade Woodpecker to version 3.16.0 or later to stop this behavior.

What to do
  • Update go.woodpecker-ci.org woodpecker to version 3.16.0.
  • Update woodpecker go.woodpecker-ci.org/woodpecker/v3 to version 3.16.0.
Affected software
Ecosystem VendorProductAffected versions
– woodpecker-ci woodpecker >= 1.0.0, < 3.16.0
go go.woodpecker-ci.org woodpecker < 3.16.0
Fix: upgrade to 3.16.0
go github.com woodpecker-ci >= 1.0.0, <= 1.0.4
go go.woodpecker-ci.org woodpecker <= 2.8.3
Go woodpecker go.woodpecker-ci.org/woodpecker/v3 < 3.16.0
Fix: upgrade to 3.16.0
Go woodpecker-ci github.com/woodpecker-ci/woodpecker >= 1.0.0, <= 1.0.4
Go woodpecker go.woodpecker-ci.org/woodpecker/v2 <= 2.8.3
Original advisory text
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
CWE-862Missing Authorization
Timeline
Published15 Sep 2026
Updated9 Oct 2026
First seen14 Jul 2026
Sources
GHSA-qf34-295c-26v8 · GHSA
CVE-2026-61549 · NVD
GHSA-qf34-295c-26v8 · OSV
CVE-2026-61549 · MITRE
CVE-2026-61549 · OSV
Track software like this
Free during beta