TI-2026-44104 CVE-2026-61549 · GHSA-qf34-295c-26v8
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Priority MEDIUM 41
Woodpecker is a CI/CD engine.
Vulnerabilities
8 records
TI-2026-42001 CVE-2026-58370 · GHSA-wpx4-jm4h-w8j6
Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name
Priority MEDIUM 43
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author.
TI-2026-42000 CVE-2026-58369 · GHSA-xq6m-xxrf-h53q
NULL pointer dereference in woodpecker-ci woodpecker
Priority LOW 37
Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser)…
TI-2026-36911 CVE-2026-50141 · GHSA-g7mm-9vx7-jm7h
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
Priority LOW 32
Woodpecker is a CI/CD engine.
TI-2024-27474 CVE-2024-41122 · GHSA-3wf2-2pq4-4rvc
Custom environment variables allow to alter execution flow of plugins in Woodpecker
Priority MEDIUM 41
Woodpecker is a simple yet powerful CI/CD engine with great extensibility.
TI-2024-27473 CVE-2024-41121 · GHSA-xw35-rrcp-g7xm
Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
Priority MEDIUM 41
Woodpecker is a simple yet powerful CI/CD engine with great extensibility.
TI-2023-20924 CVE-2023-40034 · GHSA-4gcf-5m39-98mc
Repositoty takeover in woodpecker-ci
Priority LOW 39
Woodpecker is a community fork of the Drone CI system.
TI-2022-12293 CVE-2022-29947 · GHSA-vmp5-c5hp-6c65
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
Priority LOW 28
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.