Read the docs
TI-2026-37862 Aliases CVE-2026-52744

GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

Priority LOW 25CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00583 48th percentileScored 2026-11-07
Fix Fixed gocd (gocd): 26.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gocdgocd20.2.0 to before 26.1.026.1.0Patch availableCNA
  • gocd Vendorgocd Affected 20.2.0 to before 26.1.0 Fixed in 26.1.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*——gocd
  • cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:* Versions — — ·gocd

Remediation

  • Fix · CNA gocd (gocd) Fixed in 26.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52744

References

Other 4

  • TI-2021-09947 An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version… CVSS 3.1MEDIUM 6.5
  • TI-2021-19282 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1HIGH 7.5
  • TI-2021-19285 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1CRITICAL 9.8
  • TI-2021-20193 Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be… CVSS 3.1CRITICAL 9.8
  • TI-2022-18687 Compromised agents may be able to execute remote code on GoCD Server CVSS 3.1CRITICAL 9.1
  • TI-2022-11727 Command Injection/Argument Injection in GoCD CVSS 3.1HIGH 8.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences