CVE-2026-52744: GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
An attacker must be authenticated to GoCD. They can use the internal fetch-artifact auto-suggestion endpoint to retrieve upstream dependency information that is not otherwise visible to their account in the UI.
What information can be exposed?
The issue can disclose inter-pipeline dependency hierarchy details and user-defined names for pipelines, stages, jobs, and artifact plugin references. The affected endpoint is read-only, so it does not allow pipeline data to be modified.
Which deployments are affected and how should they be remediated?
GoCD versions from 20.2.0 until 26.1.0 are affected. Upgrade to version 26.1.0, which fixes the authorization issue.