CVE-2026-58370criticalCWE-290

CVE-2026-58370: critical vulnerability in woodpecker-ci woodpecker

Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

Published · Updated

Follow this CVE+ Monitor woodpecker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.7%
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
woodpecker-ci · woodpecker
Related CVEs — woodpecker-ci woodpecker

In the same product, most dangerous first.

CVE-2023-40034HIGHRepositoty takeover in woodpecker-ciEPSS 0.9%CVE-2024-41121HIGHCustom workspace allow to overwrite plugin entrypoint executable in WoodpeckerEPSS 0.7%CVE-2026-58369MEDIUMWoodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of ServiceEPSS 0.6%CVE-2024-41122HIGHCustom environment variables allow to alter execution flow of plugins in WoodpeckerEPSS 0.6%CVE-2026-50141HIGHWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonationEPSS 0.4%CVE-2026-61549CRITICALWoodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backendEPSS 0.3%