Description

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-21T15:17:29.277Z",
  "pubdate": "2026-09-21T15:17:29.277Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within the GoCD continuous delivery server, specifically affecting the /go/api/support/process_list endpoint. The defect allows authenticated internal users to bypass intended administrative access controls and retrieve sensitive process-level metadata associated with source control child processes.\nThe scope of the vulnerability includes versions from 13.1.0 up to, but not including, 26.1.0. While credentials and environment variables are excluded from the exposed output, the vulnerability facilitates unauthorized information disclosure regarding internal material paths, remote material URLs, and command-line arguments. This exposure may provide an attacker with insights into internal infrastructure, repositories, and build configurations that are otherwise restricted based on user permissions.\nExploitation requires the attacker to be an authenticated user within the GoCD environment. Furthermore, successful data extraction is dependent on the precise, albeit unpredictable, timing of source control child processes executing during the request. Due to the requirement for internal access and specific temporal conditions, the risk is primarily associated with internal privilege escalation and reconnaissance within the CI/CD pipeline environment.",
  "technicalDetails": "The root cause of this vulnerability is an authorization enforcement failure in the /go/api/support/process_list endpoint. Although the endpoint is architecturally intended to be restricted to administrator-level users, the server-side implementation fails to validate the privileges of the requester, allowing any authenticated user to invoke the function.\nWhen a request is submitted to /go/api/support/process_list, the application executes logic to retrieve a snapshot of currently running child processes related to source control material operations. Because the access control check is absent, the backend processes the request and returns a JSON payload containing process metadata. This metadata includes command-line arguments used during VCS (Version Control System) operations, the system usernames under which these processes are spawned, internal file system paths where materials are stored, and the remote repository URLs accessed by the server.\nThe exploitation process follows a specific workflow: First, an attacker must possess valid credentials to access the GoCD server instance. Second, the attacker must interact with the /go/api/support/process_list endpoint during a window where source control child processes are active on the server. Since these processes are transient, the attacker must account for the unpredictable nature of build and material polling cycles. While the application logic masks user-defined secrets and environment variables, the disclosure of repository URLs and internal paths constitutes a significant information leak regarding the underlying CI/CD architecture.\nThe affected versions are 13.1.0 through 26.1.0. The vulnerability is restricted to the internal network or wherever the GoCD management interface is accessible. The technical impact is limited to the unauthorized disclosure of process-level information; however, in a supply chain context, the exposure of internal material paths and repository endpoints can be leveraged for lateral movement or targeted attacks against the integrated version control systems. The vulnerability is mitigated in version 26.1.0 by implementing the appropriate access control filters on the support diagnostic endpoint to ensure that only authorized administrative sessions can access the process list output."
}