CVE-2026-55060
Received Received - Intake

GoCD Unauthorized Process List Information Disclosure

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55060
EUVD
EUVD-2026-83950

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
thoughtworks gocd From 13.1.0 (inc) to 26.1.0 (exc)
thoughtworks gocd From 13.1.0 (inc) to 25.4.0 (inc)
thoughtworks gocd 26.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD is a continuous delivery server with a vulnerability in versions 13.1.0 to 26.1.0. The /go/api/support/process_list endpoint lacks proper admin-only authorization. An authenticated internal user can access this endpoint while source control child processes are running and view details like command-line arguments, usernames, remote material URLs, and internal material paths for materials they shouldn't access. The issue is fixed in version 26.1.0.

Detection Guidance

Monitor for unauthorized access to the /go/api/support/process_list endpoint. Check GoCD server logs for requests to this path, especially from non-admin users. Use network monitoring tools to inspect traffic to this endpoint if exposed.

Impact Analysis

This vulnerability allows an authenticated internal user to gain limited information about GoCD server deployments. They can view material-related details such as command-line arguments for source control processes, usernames, remote URLs, and internal paths. However, sensitive data like credentials, environment variables, and user-defined secrets remain protected.

Compliance Impact

This vulnerability allows unauthorized internal users to view limited system information such as usernames, material paths, and remote URLs. While sensitive data like credentials and secrets are not exposed, the unauthorized access to user-related information could potentially conflict with GDPR's data minimization and access control principles. HIPAA compliance may also be impacted if user or system information related to healthcare environments is exposed.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later. Alternatively, block access to /go/api/support/process_list via a reverse proxy or CDN until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart