CVE-2026-55625
Received Received - Intake

Privilege Escalation in GoCD via Unauthorized Material Test API

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55625
EUVD
EUVD-2026-83952

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
thoughtworks gocd 26.1.0
thoughtworks gocd From 16.1.0 (inc) to 26.1.0 (inc)
thoughtworks gocd 16.1.0
thoughtworks gocd From 16.1.0 (inc) to 25.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD versions 16.1.0 to 26.1.0 have an authorization bypass vulnerability in internal APIs used for testing material connections. Pipeline group administrators can invoke Test Connection for source control materials outside their authorized pipeline group or configuration repository. This allows potential access to credentials from those materials. For GoCD 20.6.0 and later, external secrets managed by secret-management plugins may also be accessed.

Detection Guidance

Check GoCD server versions between 16.1.0 and 26.1.0. Inspect logs for unauthorized access attempts to /go/api/admin/internal/material_test or /go/api/internal/config_repos/*/material_test endpoints. Monitor for pipeline group admins testing connections outside their authorized scope.

Impact Analysis

A pipeline group administrator could exploit this to access source control credentials they should not have permission to view. In deployments using secret management plugins, they might also access external secrets, including global reusable secrets with separate permissions. This could lead to unauthorized access to sensitive data or systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized credential access could result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later. Block access to the vulnerable API endpoints via reverse proxy or CDN to disable the Test Connection functionality. Review and restrict pipeline group admin permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart