CVE-2026-52742
Received Received - Intake

Legacy Route Exposure in GoCD Server Configuration

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists. A malicious pipeline group administrator can use disclosed agent registration data to connect a rogue compatible agent, which can create a higher-complexity path to receiving work or overwriting artifacts associated with other groups. Normal authenticated users are not affected, the endpoint does not modify server configuration, and deployments that restrict pipeline editing to full administrators or configuration repositories are not affected. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-52742
EUVD
EUVD-2026-83954

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thoughtworks gocd From 12.3.1 (inc) to 25.4.0 (inc)
thoughtworks gocd 26.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD versions between 12.3.1 and 26.1.0 have a flaw where pipeline group administrators can access the entire server configuration through legacy routes under /go/admin/restful/*. This includes sensitive data like agent registration keys, webhook keys, encrypted credentials, and admin lists. The issue is an authorization bypass that exposes more information than intended. It does not allow modifying server settings or full privilege escalation but could enable a malicious insider to act as an agent or leak data from other pipeline groups.

Detection Guidance

Check GoCD server logs for unauthorized access to /go/admin/restful/* endpoints. Monitor network traffic for requests to these paths. Use tools like curl to test if sensitive data is exposed: curl -k https://<gocd-server>/go/admin/restful/server-configuration. Ensure only authorized users have pipeline group admin privileges.

Impact Analysis

If you are a pipeline group administrator in GoCD versions 12.3.1 to 26.1.0, a malicious actor with your access level could exploit this to view sensitive server configuration details. This includes credentials and keys that might allow them to connect unauthorized agents or access restricted data. Normal users without admin rights are not affected. The impact is limited to information disclosure and potential agent-based attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as credentials and configuration details, which may violate GDPR or HIPAA requirements for data protection and access controls. Exposure of such information could result in non-compliance due to insufficient safeguards for personal or health data.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later. Block access to /go/admin/restful/* via reverse proxy or firewall rules. Remove admin permissions from pipeline groups if not required. Restrict network access to GoCD agent APIs at /go/remoting/**.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart