Read the docs
TI-2026-42001 Aliases CVE-2026-58370GHSA-wpx4-jm4h-w8j6

Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

Priority MEDIUM 43CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00719 54th percentileScored 2026-11-07
Fix Fixed woodpecker (woodpecker-ci): 3.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
woodpecker-ciwoodpeckerbefore 3.15.03.15.0Patch availableCNA
  • woodpecker Vendorwoodpecker-ci Affected before 3.15.0 Fixed in 3.15.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:*——woodpecker-ci
  • cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* Versions — — ·woodpecker-ci

Remediation

  • Fix · CNA woodpecker (woodpecker-ci) Fixed in 3.15.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    woodpecker-ci woodpecker 3.15.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-42000 NULL pointer dereference in woodpecker-ci woodpeckerPriority LOW 37
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58370
  2. 2026-10-03 Alias added: GHSA-wpx4-jm4h-w8j6

References

Patch 1

Other 2

  • TI-2026-44104 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend CVSS 4.0CRITICAL 9.0
  • TI-2024-27474 Custom environment variables allow to alter execution flow of plugins in Woodpecker CVSS 3.1HIGH 8.8
  • TI-2024-27473 Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker CVSS 3.1HIGH 8.8
  • TI-2023-20924 Repositoty takeover in woodpecker-ci CVSS 3.1HIGH 8.1
  • TI-2026-42000 NULL pointer dereference in woodpecker-ci woodpecker CVSS 4.0MEDIUM 6.9
  • TI-2026-36911 Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences