CVE-2026-58370 Details
Description
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.
A vulnerability exists in Woodpecker CI versions prior to 3.15.0, specifically within the GitLab forge driver. The issue arises because the ApprovalAllowedUsers bypass list is incorrectly matched against the pipeline author, which is derived from the git commit author name in the webhook payload. This author name is controlled by the attacker and not validated by GitLab. Consequently, a user who can initiate a merge request from a fork can manipulate the commit author name to align with an entry in ApprovalAllowedUsers. This manipulation causes the needsApproval status to return false, allowing the pipeline to execute without the necessary approval. This flaw undermines the fork-approval security boundary, enabling the execution of unauthorized pipeline steps on a Woodpecker agent and the exfiltration of CI secrets exposed during the run.
Users can upgrade to Woodpecker CI version 3.15.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Woodpecker | < 3.15.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |