Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| woodpecker-ci | woodpecker | before 2.7.0 | 2.7.0 | Patch available | CNA |
| — | go.woodpecker-ci.org/woodpecker/v2 (Go) | before 2.7.0 | 2.7.0 | Patch available | GHSA-xw35-rrcp-g7xm |
| — | go.woodpecker-ci.org/woodpecker (Go) | before 2.7.0 | 2.7.0 | Patch available | GHSA-xw35-rrcp-g7xm |
- woodpecker Vendorwoodpecker-ci Affected before 2.7.0 Fixed in 2.7.0 Patch available CNA
- go.woodpecker-ci.org/woodpecker/v2 (Go) Vendor— Affected before 2.7.0 Fixed in 2.7.0 Patch available GHSA-xw35-rrcp-g7xm
- go.woodpecker-ci.org/woodpecker (Go) Vendor— Affected before 2.7.0 Fixed in 2.7.0 Patch available GHSA-xw35-rrcp-g7xm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* | before 2.7.0 | Vulnerable | woodpecker-ci |
- cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·woodpecker-ci
Remediation
- Fix · CNA woodpecker (woodpecker-ci) Fixed in 2.7.0
- Fix · GHSA-xw35-rrcp-g7xm go.woodpecker-ci.org/woodpecker/v2 (Go) Fixed in 2.7.0 Advisory →
- Fix · GHSA-xw35-rrcp-g7xm go.woodpecker-ci.org/woodpecker (Go) Fixed in 2.7.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41121
- 2026-10-03 Alias added: GHSA-xw35-rrcp-g7xm
References
Patch 2
Advisory 2
Other 6
- https://github.com/woodpecker-ci/woodpecker-security/issues/8
- https://github.com/woodpecker-ci/woodpecker-security/issues/9
- https://github.com/woodpecker-ci/woodpecker-security/pull/11
- https://github.com/woodpecker-ci/woodpecker/commit/764329ed1dbc47c4a517ccc749e3feb34059fac8
- https://github.com/woodpecker-ci/woodpecker
- https://pkg.go.dev/vuln/GO-2024-2999
More woodpecker-ci Woodpecker vulnerabilities
- TI-2024-27474 Custom environment variables allow to alter execution flow of plugins in Woodpecker CVSS 3.1HIGH 8.8
- TI-2023-20924 Repositoty takeover in woodpecker-ci CVSS 3.1HIGH 8.1
- TI-2022-12293 Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2024-41121 · CVE Program
- CVE-2024-41121 · NVD
- FIRST EPSS
- GHSA-xw35-rrcp-g7xm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences