CVE-2026-55870: GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Which GoCD configurations are exposed?
Affected configurations are source control materials with credentials stored in the URL userinfo portion. Dedicated username and password fields and secret-management plugins are the recommended alternatives; dedicated password fields are not exposed by this issue.
What access does an attacker need?
An attacker must be an authenticated regular user with access to an affected pipeline. The credentials can be obtained through several read-only APIs.
Are default credential-storage methods affected?
Credentials stored in GoCD's dedicated password fields remain encrypted and are not exposed by this issue. The exposure applies to legacy configurations that embed credentials directly in material URLs.
What can be done before upgrading?
Remove credentials from source control material URLs and use dedicated username and password fields or a secret-management plugin instead. Upgrade to GoCD 26.1.0 to apply the fix.
How can teams identify potentially affected pipelines?
Review source control material URLs for embedded userinfo credentials. Pipelines using those legacy URL-embedded credentials should be treated as exposed if accessible to authenticated users.