Read the docs
TI-2026-44104 Aliases CVE-2026-61549GHSA-qf34-295c-26v8

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

Priority MEDIUM 41CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-862.

Summary

Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Fix Fixed woodpecker (woodpecker-ci): 3.16.0go.woodpecker-ci.org/woodpecker/v3 (Go): 3.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
woodpecker-ciwoodpecker1.0.0 to before 3.16.03.16.0Patch availableCNA
—go.woodpecker-ci.org/woodpecker/v3 (Go)before 3.16.03.16.0Patch availableGHSA-qf34-295c-26v8
—github.com/woodpecker-ci/woodpecker (Go)1.0.0 – 1.0.4—No fix listedGHSA-qf34-295c-26v8
—go.woodpecker-ci.org/woodpecker/v2 (Go)up to 2.8.3—No fix listedGHSA-qf34-295c-26v8
  • woodpecker Vendorwoodpecker-ci Affected 1.0.0 to before 3.16.0 Fixed in 3.16.0 Patch available CNA
  • go.woodpecker-ci.org/woodpecker/v3 (Go) Vendor— Affected before 3.16.0 Fixed in 3.16.0 Patch available GHSA-qf34-295c-26v8
  • github.com/woodpecker-ci/woodpecker (Go) Vendor— Affected 1.0.0 – 1.0.4 Fixed in — No fix listed GHSA-qf34-295c-26v8
  • go.woodpecker-ci.org/woodpecker/v2 (Go) Vendor— Affected up to 2.8.3 Fixed in — No fix listed GHSA-qf34-295c-26v8

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:*——woodpecker-ci
  • cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* Versions — — ·woodpecker-ci

Remediation

  • Fix · CNA woodpecker (woodpecker-ci) Fixed in 3.16.0
  • Fix · GHSA-qf34-295c-26v8 go.woodpecker-ci.org/woodpecker/v3 (Go) Fixed in 3.16.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61549
  2. 2026-10-03 Alias added: GHSA-qf34-295c-26v8

References

Other 6

  • TI-2026-42001 Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name CVSS 4.0CRITICAL 9.2
  • TI-2024-27474 Custom environment variables allow to alter execution flow of plugins in Woodpecker CVSS 3.1HIGH 8.8
  • TI-2024-27473 Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker CVSS 3.1HIGH 8.8
  • TI-2023-20924 Repositoty takeover in woodpecker-ci CVSS 3.1HIGH 8.1
  • TI-2026-42000 NULL pointer dereference in woodpecker-ci woodpecker CVSS 4.0MEDIUM 6.9
  • TI-2026-36911 Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences