CVE-2026-58370criticalCWE-290

CVE-2026-58370: falha crítica em woodpecker-ci woodpecker

Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar woodpecker

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.7%
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
woodpecker-ci · woodpecker
CVEs relacionadas — woodpecker-ci woodpecker

No mesmo produto, das mais perigosas para as menos.

CVE-2023-40034HIGHRepositoty takeover in woodpecker-ciEPSS 0.9%CVE-2024-41121HIGHCustom workspace allow to overwrite plugin entrypoint executable in WoodpeckerEPSS 0.7%CVE-2026-58369MEDIUMWoodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of ServiceEPSS 0.6%CVE-2024-41122HIGHCustom environment variables allow to alter execution flow of plugins in WoodpeckerEPSS 0.6%CVE-2026-50141HIGHWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonationEPSS 0.4%CVE-2026-61549CRITICALWoodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backendEPSS 0.3%