CVE-2026-52744
Received Received - Intake

GoCD UI Fetch-Artifact API Unauthorized Access Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-52744
EUVD
EUVD-2026-85516

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
thoughtworks gocd From 20.2.0 (inc) to 26.1.0 (inc)
thoughtworks gocd 26.1.0
thoughtworks gocd From 20.2.0 (inc) to 25.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GoCD versions 20.2.0 to 26.1.0 involves an authorization bypass in an internal API endpoint (/go/api/internal/pipelines/**/upstream). An authenticated user can access upstream dependency data and pipeline details they are not permitted to view through the UI. The endpoint is read-only and does not allow modification of data.

Detection Guidance

Check if your GoCD version is between 20.2.0 and 26.1.0. If so, inspect network traffic for unauthorized access to the endpoint /go/api/internal/pipelines/**/upstream. Use reverse proxy logs to detect requests to this path.

Impact Analysis

An attacker with valid GoCD credentials could view sensitive pipeline, stage, job, and artifact plugin names they should not have access to. This exposes internal system structure but does not allow data modification or direct system compromise.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later immediately. As a temporary measure, block access to /go/api/internal/pipelines/**/upstream via reverse proxy or firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart