Authorization Bypass in GoCD Continuous Delivery Server

CVE-2026-52740

What is CVE-2026-52740?

GoCD, a widely used continuous delivery server, exhibits a vulnerability in its Get Template Config API, which improperly handles case sensitivity in HTTP methods. This flaw permits lower-privileged authenticated users to exploit the API by sending requests with variably capitalized HTTP method names. Consequently, they may gain unauthorized access to pipeline templates and their configurations without possessing the necessary viewing permissions. Notably, operations that modify data are safeguarded, encrypted variables remain secure, and the issue primarily impacts environments that do not enforce strict HTTP method capitalization through reverse proxies. The vulnerability has been addressed in version 26.1.0 of GoCD.

References