CVE-2024-41122

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-74

• https://github.com/woodpecker-ci/woodpecker-security/issues/10Broken Link
• https://github.com/woodpecker-ci/woodpecker/issues/3929Patch
• https://github.com/woodpecker-ci/woodpecker/pull/3909Patch
• https://github.com/woodpecker-ci/woodpecker/pull/3934Patch
• https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvcThird Party Advisory
• https://github.com/woodpecker-ci/woodpecker-security/issues/10Broken Link
• https://github.com/woodpecker-ci/woodpecker/issues/3929Patch
• https://github.com/woodpecker-ci/woodpecker/pull/3909Patch
• https://github.com/woodpecker-ci/woodpecker/pull/3934Patch
• https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvcThird Party Advisory

Published

Jul 19, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41117streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41118streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41119streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-4112A vulnerability classified as critical has been found in Ten…8.8
• CVE-2024-41120streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41121Woodpecker is a simple yet powerful CI/CD engine with great …8.8
• CVE-2024-41123REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2…7.5
• CVE-2024-41124Puncia is the Official CLI utility for Subdomain Center & Ex…6.3
• CVE-2024-41125Contiki-NG is an open-source, cross-platform operating syste…9.6
• CVE-2024-41126Contiki-NG is an open-source, cross-platform operating syste…9.6
• CVE-2024-41127Monkeytype is a minimalistic and customizable typing test. M…9.6
• CVE-2024-41128Action Pack is a framework for handling and responding to we…6.6