woodpecker-ci

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

woodpecker-ci records in CISA KEV

No woodpecker-ci vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Woodpecker 4 records MEDIUM

Records

8 records

TI-2026-42001 CVE-2026-58370 · GHSA-wpx4-jm4h-w8j6

Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

MEDIUM 43

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00719 Published 2026-06-30 Fixed in 3.15.0 CWE-290

TI-2026-44104 CVE-2026-61549 · GHSA-qf34-295c-26v8

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

MEDIUM 41

Woodpecker is a CI/CD engine.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00278 Published 2026-09-15 Fixed in 3.16.0 CWE-269

TI-2024-27474 CVE-2024-41122 · GHSA-3wf2-2pq4-4rvc

Custom environment variables allow to alter execution flow of plugins in Woodpecker

MEDIUM 41

Woodpecker is a simple yet powerful CI/CD engine with great extensibility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00618 Published 2024-07-19 Fixed in 2.7.0 CWE-74

TI-2024-27473 CVE-2024-41121 · GHSA-xw35-rrcp-g7xm

Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker

MEDIUM 41

Woodpecker is a simple yet powerful CI/CD engine with great extensibility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00737 Published 2024-07-19 Fixed in 2.7.0 CWE-74

TI-2023-20924 CVE-2023-40034 · GHSA-4gcf-5m39-98mc

Repositoty takeover in woodpecker-ci

LOW 39

Woodpecker is a community fork of the Drone CI system.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00883 Published 2023-08-16 Fixed in 1.0.2 CWE-20

TI-2026-42000 CVE-2026-58369 · GHSA-xq6m-xxrf-h53q

NULL pointer dereference in woodpecker-ci woodpecker

LOW 37

Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser)…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00637 Published 2026-06-30 Fixed in 3.15.0 CWE-476

TI-2026-36911 CVE-2026-50141 · GHSA-g7mm-9vx7-jm7h

Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

LOW 32

Woodpecker is a CI/CD engine.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00427 Published 2026-06-18 Fixed in 3.14.1 CWE-290

TI-2022-12293 CVE-2022-29947 · GHSA-vmp5-c5hp-6c65

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

LOW 28

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-04-29 Fixed in 0.15.1 CWE-79

Open these records in search →

Critical	2
High	4
Medium	2
Low	0
No CVSS	0