CVE-2026-58370
Last modified
CVE-2026-58370 is a critical-severity vulnerability rated 9.2/10 on the CVSS scale. Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| woodpecker-ci | woodpecker | < 3.15.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-58370?
How severe is CVE-2026-58370?
How do I fix CVE-2026-58370?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-5833A security vulnerability has been detected in awwaiid mcp-se…5.3
- CVE-2026-5834A vulnerability was detected in code-projects Online Shoe St…2.4
- CVE-2026-5835A flaw has been found in code-projects Online Shoe Store 1.0…2.4
- CVE-2026-5836A vulnerability has been found in code-projects Online Shoe …2.4
- CVE-2026-58369Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org…6.9
- CVE-2026-5837A vulnerability was found in PHPGurukul News Portal Project …7.3
- CVE-2026-58371SeaweedFS before 4.30 reflects the callback query parameter …3.1
- CVE-2026-58372SeaweedFS before 4.34 contains a path traversal vulnerabilit…8.1
- CVE-2026-58373CVAT before 2.69.0 contains an improper authorization vulner…5.3
- CVE-2026-58374In hostapd before 2.12, a missing bounds check in AP-mode Wi…7.1
- CVE-2026-58375JimuReport through 2.5.0 exposes the POST /jmreport/auto/exp…8.7
- CVE-2026-58376Dolibarr through 23.0.3, fixed in commit 14db36e, contains a…7.6
Are you affected by CVE-2026-58370?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST