CVE-2026-58370criticalCWE-290

CVE-2026-58370: fallo crítico en woodpecker-ci woodpecker

Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear woodpecker

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.2epss 0.7%
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
woodpecker-ci · woodpecker
CVEs relacionadas — woodpecker-ci woodpecker

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-40034HIGHRepositoty takeover in woodpecker-ciEPSS 0.9%CVE-2024-41121HIGHCustom workspace allow to overwrite plugin entrypoint executable in WoodpeckerEPSS 0.7%CVE-2026-58369MEDIUMWoodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of ServiceEPSS 0.6%CVE-2024-41122HIGHCustom environment variables allow to alter execution flow of plugins in WoodpeckerEPSS 0.6%CVE-2026-50141HIGHWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonationEPSS 0.4%CVE-2026-61549CRITICALWoodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backendEPSS 0.3%