CVE-2026-52743: GoCD before 26.1.0 is vulnerable to authorization bypass via job status API
GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated GoCD user can exploit it by requesting a server-assigned job ID that belongs to a pipeline or stage they are not authorized to view. The user must be able to guess job IDs; no user interaction is required.
What information can be exposed?
The affected API can disclose job names, job state, progress timestamps, assigned agent IP addresses and UUIDs, and related stage and pipeline information. It does not expose console output, artifacts, commands, variables, or configuration.
Which deployments are affected?
GoCD versions before 26.1.0 are affected where authenticated users can access the internal UI /jobStatus.json API. Version 26.1.0 contains the fix.
How can I determine whether the issue has been addressed?
Verify the deployed GoCD version. Deployments running 26.1.0 are fixed; deployments running a version earlier than 26.1.0 should be treated as affected.