Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-55060GoCD is vulnerable to authorization bypass via support process list API

Low 3.7

In plain English

A low-severity incorrect authorization in gocd from gocd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.4%top 64.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.

Affected products (as reported)

Vendor	Product	Versions
gocd	gocd	>= 13.1.0, < 26.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/gocd/gocd/security/advisories/GHSA-vqjf-7pf8-hgwr x_refsource_CONFIRM
https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8 x_refsource_MISC
https://github.com/gocd/gocd/releases/tag/26.1.0 x_refsource_MISC
https://www.gocd.org/releases/#26-1-0 x_refsource_MISC