Approval Bypass in Woodpecker CI Affects GitLab Integration

CVE-2026-58370

What is CVE-2026-58370?

Woodpecker CI versions prior to 3.15.0 exhibit a vulnerability that allows for an Approval Bypass specifically in GitLab integrations. The pipeline.Author field, which derives its value from the git commit author name present in the webhook payload, can be manipulated by an attacker. Because this author name is not verified by GitLab, an individual with access to create a merge request from a fork can spoof the commit author name to mimic entries in the ApprovalAllowedUsers list. As a result, the needsApproval check returns false, permitting the unauthorized execution of pipeline steps without requisite approvals. This breach of the fork-approval security boundary creates avenues for executing arbitrary code within a Woodpecker agent, potentially leading to the exfiltration of sensitive CI secrets. Other forge drivers like Gitea, Forgejo, GitHub, and Bitbucket are not impacted as they validate the sender/actor identity.

References