CVE-2026-52740: GoCD is vulnerable to pipeline template view API authorization bypass
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to this authorization bypass?
GoCD versions from 18.7.0 through before 26.1.0 are affected if requests using non-uppercase HTTP method capitalization can reach GoCD. Deployments behind a reverse proxy that rejects non-uppercase HTTP methods are not affected.
What access does an attacker need?
An attacker must be an authenticated GoCD user with lower privileges. They can use a nonstandard capitalization of the HTTP method when calling the Get Template Config API to bypass the required template view permission.
What information can be accessed, and can the issue be used to alter pipelines?
The bypass permits reading a pipeline template's configuration by name. Data-modifying API operations are not affected, and secure variables remain encrypted.
What can be done before upgrading?
Ensure the reverse proxy in front of GoCD rejects HTTP methods that are not uppercase, preventing the nonstandard method capitalization required for exploitation. Upgrade GoCD to version 26.1.0 to fix the issue.