gRPC Layer Vulnerability in Woodpecker CI/CD Engine

CVE-2026-50141

What is CVE-2026-50141?

The Woodpecker CI/CD engine is susceptible to a gRPC layer vulnerability that allows authenticated agents to impersonate other agents on the same server. This is achieved by injecting a falsified agent_id into the outgoing gRPC metadata. Although the server accurately validates the JWT token, it subsequently disregards the verified agent identity in favor of the client-supplied value, leading to potential security risks. The issue has been resolved in version 3.14.1. As a precautionary measure, users are advised to disable organization agents by setting 'WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true' and to remove any existing agents.

References