Service Account Misconfiguration in Woodpecker CI/CD Engine
CVE-2026-61549

9CRITICAL

Key Information:

Vendor: Woodpecker-ci
Status: Woodpecker
Vendor: CVE Published:; 15 September 2026

🔔 Create Woodpecker-ci Vulnerability Alert

What is CVE-2026-61549?

The Woodpecker CI/CD Engine has a vulnerability that allows users with Push permissions on a connected repository to run pipeline pods using an arbitrary ServiceAccount. This vulnerability arises from a misconfiguration in the handling of serviceAccountName, allowing unauthorized access to RBAC permissions. As a result, an attacker can potentially exfiltrate sensitive information, including database credentials and API keys, and may gain control over the Kubernetes cluster. The issue has been addressed in version 3.16.0.