CVE-2026-52744 Details
Description
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.
An authorization bypass vulnerability has been identified in the GoCD continuous delivery server, affecting versions 20.2.0 prior to 26.1.0. The issue resides in the internal UI fetch-artifact auto-suggestion API, which fails to properly authorize access to upstream dependency data. This allows authenticated users to retrieve details about inter-pipeline dependency hierarchies, as well as user-defined names for pipelines, stages, jobs, and artifact plugins that are not otherwise visible in the UI. While the endpoint is read-only and does not allow modifications to pipeline data, the vulnerability could still lead to unintended exposure of information. The flaw has been addressed in GoCD version 26.1.0.
Users are advised to upgrade to GoCD version 26.1.0, where this vulnerability has been fixed. Instructions for upgrading can be found in the GoCD release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c | [email protected] | Source CodeVendor |
| https://github.com/gocd/gocd/releases/tag/26.1.0 | [email protected] | Release NotesVendor |
| https://github.com/gocd/gocd/security/advisories/GHSA-mvpm-hmc9-2q8p | [email protected] | AdvisoryRemedyVendor |
| https://www.gocd.org/releases/#26-1-0 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GoCD | >= 20.2.0, < 26.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 29, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |