CVE-2026-55625

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.

• CWE-639
• CWE-863

• https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918
• https://github.com/gocd/gocd/releases/tag/26.1.0
• https://github.com/gocd/gocd/security/advisories/GHSA-4557-94j8-5p66
• https://www.gocd.org/releases/#26-1-0

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5562A vulnerability was identified in provectus kafka-ui up to 0…9.8
• CVE-2026-55620eml_parser serves as a python module for parsing eml files a…7.5
• CVE-2026-55621Incus is a system container and virtual machine manager. Pri…7.7
• CVE-2026-55622Incus is a system container and virtual machine manager. Pri…7.7
• CVE-2026-55623Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-55624MintyItanium Lost-Auction is an auction plugin for Minecraft…5.3
• CVE-2026-55626xrdp is an open source RDP server. In versions 0.10.6 and pr…7.3
• CVE-2026-55628ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55629Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging pr…8.7
• CVE-2026-5563A security flaw has been discovered in AutohomeCorp frostmou…6.3
• CVE-2026-55630Kiwi TCMS is an open source test management system. Prior to…0
• CVE-2026-55631DataEase is an open source data visualization and analysis t…7.2