CVE-2026-52740
Received Received - Intake

GoCD API Template Config Access via Case-Insensitive HTTP Method

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-52740
EUVD
EUVD-2026-83951

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
thoughtworks gocd From 18.7.0 (inc) to 26.1.0 (inc)
thoughtworks gocd From 18.7.0 (inc) to 25.4.0 (inc)
thoughtworks gocd 26.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD is a continuous delivery server vulnerable to an authorization bypass in versions 18.7.0 to 26.1.0. The Get Template Config API incorrectly checks HTTP method names case-sensitively, allowing lower-privileged users to access pipeline templates without proper view permissions by using nonstandard capitalization in requests.

Detection Guidance

Check GoCD server logs for API requests using non-standard HTTP method capitalization (e.g., 'get' instead of 'GET') to the Get Template Config endpoint. Monitor for unauthorized access attempts to pipeline templates by lower-privileged users.

Impact Analysis

A lower-privileged authenticated user could read pipeline template configurations they are not authorized to access. However, data-modifying operations are unaffected, secure variables remain encrypted, and deployments with reverse proxies rejecting non-uppercase HTTP methods are not impacted.

Compliance Impact

This vulnerability allows lower-privileged users to access pipeline template configurations they are not authorized to view, which could potentially expose sensitive data. While the impact is considered low due to templates typically lacking sensitive information, unauthorized access may still violate data protection requirements under GDPR or HIPAA if such data is present. The risk is mitigated by encrypted secure variables and deployments using reverse proxies that enforce strict HTTP method validation.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later. Alternatively, configure reverse proxies or API gateways to enforce uppercase HTTP methods. Avoid using pipeline templates if possible, opting for config-as-code approaches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart