CVE-2026-52742: GoCD is vulnerable to historical server configuration API authorization bypass
GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists. A malicious pipeline group administrator can use disclosed agent registration data to connect a rogue compatible agent, which can create a higher-complexity path to receiving work or overwriting artifacts associated with other groups. Normal authenticated users are not affected, the endpoint does not modify server configuration, and deployments that restrict pipeline editing to full administrators or configuration repositories are not affected. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running versions from 12.3.1 through versions before 26.1.0 are exposed if pipeline group administrators can edit pipelines. Deployments that restrict pipeline editing to full administrators or configuration repositories are not affected.
What level of access does an attacker need?
An attacker must be a pipeline group administrator. Normal authenticated users are not affected.
What could a pipeline group administrator obtain or do?
They can retrieve historical full server configuration through legacy /go/admin/restful/* routes, including agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists. Disclosed agent registration data can be used to connect a rogue compatible agent, creating a more complex path to receiving work or overwriting artifacts associated with other groups.
Does exploiting this vulnerability change server configuration?
No. The affected endpoint discloses configuration but does not modify server configuration.
What is the available remediation?
Upgrade to GoCD version 26.1.0, which fixes the issue. If an immediate upgrade is not possible, restrict pipeline editing to full administrators or configuration repositories.