CVE-2026-55870
Received Received - Intake

GoCD Unmasked Credentials Exposure in Material URLs

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55870
EUVD
EUVD-2026-83953

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thoughtworks gocd to 26.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD versions before 26.1.0 have a vulnerability where unmasked credentials stored in source control material URLs are exposed through read-only APIs. This happens because some APIs do not consistently mask credentials in URLs, even though GoCD recommends using dedicated fields or secret-management plugins for credentials.

Detection Guidance

To detect this vulnerability, check GoCD API responses for material URLs containing unmasked credentials. Use API endpoints like /api/admin/pipelines or /api/config/materials and inspect JSON responses for URLs with userinfo (e.g., http://user:password@host). Compare responses between GoCD versions before and after 26.1.0 to identify inconsistencies in credential masking.

Impact Analysis

An authenticated user with access to an affected pipeline could retrieve credentials embedded in its material URL. This could lead to unauthorized access to source control systems or other resources if those credentials are reused elsewhere.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing credentials in URLs through APIs. Unauthorized access to credentials may lead to data breaches, violating confidentiality requirements under these regulations. However, the vulnerability is mitigated by the fact that only legacy configurations with credentials in URLs are affected, and dedicated password fields remain encrypted.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later to enable automatic URL masking in APIs. Review all material configurations to remove credentials from URLs, replacing them with dedicated username/password fields or Secrets Management plugins. Audit API responses for any exposed credentials and rotate compromised credentials immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart