CVE-2026-52743
Received Received - Intake

GoCD UI Job Status Information Exposure via Job ID Guessing

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-52743
EUVD
EUVD-2026-83941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thoughtworks gocd 26.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GoCD versions before 26.1.0 allows an authenticated user to bypass authorization and retrieve job status details for pipelines they do not have permission to view by guessing server-assigned job IDs. The exposed information includes job names, status, timestamps, agent details, and pipeline/stage information but excludes sensitive data like console output or configuration.

Detection Guidance

This vulnerability involves an authorization bypass in GoCD's internal job status API. To detect it, monitor for unauthorized access attempts to /jobStatus.json API endpoints. Check GoCD server logs for requests with mismatched pipeline/stage names and job IDs. No specific commands are provided in the context, but inspecting access logs for suspicious API calls may help identify exploitation attempts.

Impact Analysis

An attacker with valid access could exploit this to gather internal job details, potentially aiding further attacks. However, the impact is limited as no sensitive data like credentials or configuration is exposed. The risk is considered moderate due to low attack complexity and required privileges.

Compliance Impact

This vulnerability does not directly expose highly sensitive data like console output, artifacts, commands, variables, or configuration, which are typically required for GDPR or HIPAA compliance violations. However, it may indirectly impact compliance by allowing unauthorized access to job metadata such as names, statuses, timestamps, and agent details, which could be considered sensitive operational information depending on organizational policies.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later immediately to patch the vulnerability. The context does not provide alternative mitigation steps, so upgrading is the only recommended action. Ensure backups are taken before upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart