Woodpecker CI/CD Engine Vulnerability

CVE-2024-41121

What is CVE-2024-41121?

A significant vulnerability has been identified in the Woodpecker CI/CD engine that allows the creation of malicious workflows by unauthorized users. These workflows can lead to a complete host takeover, enabling the execution of arbitrary code on the host running the agent. Additionally, this vulnerability allows attackers to extract sensitive secrets typically provided to plugins, which could be exploited by modifying their entry points. The issue is addressed in version 2.7.0 of the Woodpecker CI/CD engine. Users are urged to upgrade to this version as there are no known workarounds to mitigate this vulnerability.

References