CVE-2026-55060: GoCD is vulnerable to authorization bypass via support process list API
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated internal GoCD user can exploit it; administrator privileges are not required. The affected endpoint is intended to be administrator-only but does not enforce that restriction.
What information could be exposed?
An attacker may view command-line arguments, usernames, remote material URLs, and internal material paths associated with source-control child processes. Credentials, environment variables, and user-defined secrets are masked or omitted.
What conditions are required for exploitation?
A source-control child process must be running when the authenticated user queries the process-list endpoint. Exploitation depends on unpredictable process timing, making successful observation conditional on catching an active process.
Which versions are affected and how can the issue be remediated?
GoCD versions from 13.1.0 until 26.1.0 are affected. Upgrade to version 26.1.0, which fixes the authorization enforcement issue.