CVE-2026-50141 Details
Description
Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones.
A vulnerability in Woodpecker CI's gRPC layer, present in versions 3.0.0 prior to 3.14.1, allowed authenticated agents to impersonate other agents on the same server. This was achieved by injecting a fake 'agent_id' into outgoing gRPC metadata. While the server correctly verified the JWT token, it replaced the verified agent identity with the client-supplied value. This vulnerability could be exploited by sending a forged 'agent_id' before the actual token, causing the server to use the fake identity for subsequent operations.
Users can upgrade to Woodpecker CI version 3.14.1 or newer to address this vulnerability. As an additional step, existing organization agents can be deleted and user agent registration can be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/woodpecker-ci/woodpecker/issues/6541 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/woodpecker-ci/woodpecker/pull/6567 | [email protected] | Source CodeVendor |
| https://github.com/woodpecker-ci/woodpecker/pull/6569 | [email protected] | Source CodeVendor |
| https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h | [email protected] | AdvisoryRemedyVendor |
| https://github.com/woodpecker-ci/woodpecker-security/issues/21 | [email protected] | Broken LinkIssue TrackingVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Woodpecker | >= 3.0.0, < 3.14.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |