Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58370Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

High 8.1

In plain English

A high-severity authentication bypass by spoofing in woodpecker from woodpecker-ci. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.

Affected products (as reported)

Vendor	Product	Versions
woodpecker-ci	woodpecker	0 – before 3.15.0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/woodpecker-gitlab-approval-gate-bypass-via-spoofable-commit-author-name third-party-advisory