Authorization Bypass in GoCD Continuous Delivery Server
CVE-2026-55060

3.7LOW

Key Information:

Vendor

Gocd

Status
Gocd
Vendor
CVE Published:
21 September 2026

What is CVE-2026-55060?

An authorization bypass vulnerability in GoCD allows authenticated internal users to access sensitive command-line arguments, usernames, and URLs associated with running source control processes through the /go/api/support/process_list endpoint. This flaw affects versions from 13.1.0 to 26.1.0, enabling users to acquire information they would not normally have access to, although sensitive credentials and user-defined secrets remain concealed. The issue has been addressed and resolved in version 26.1.0.

Affected Version(s)

gocd >= 13.1.0, < 26.1.0

References

https://github.com/gocd/gocd/security/advisories/GHSA-vqj...
x_refsource_CONFIRM
https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87...
x_refsource_MISC
https://github.com/gocd/gocd/releases/tag/26.1.0
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.