Description

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-21T15:17:29.967Z",
  "pubdate": "2026-09-21T15:17:29.967Z",
  "executiveSummary": "This vulnerability is an improper authorization flaw affecting the GoCD continuous delivery server. It allows authenticated pipeline group administrators to perform unauthorized actions by interacting with internal material connection test APIs. Specifically, the application fails to validate the scope of requests, permitting administrators to reference pipelines, configuration repositories, and materials residing outside their authorized administrative domain.\nThe vulnerability spans GoCD versions 16.1.0 through 26.1.0. For instances running version 20.6.0 or later, the security impact is significantly escalated as the flaw allows for the resolution of external secrets managed by secret-management plugins. This includes global secrets that may possess distinct access control permissions.\nThe risk implication is a potential breach of confidentiality and security boundary circumvention. An attacker with standard pipeline group administrator privileges can leverage these test endpoints to perform reconnaissance on external systems or extract sensitive credentials associated with materials they are not authorized to manage. Exploitation requires authenticated access to the GoCD dashboard, but does not necessitate system-level administrative rights.",
  "technicalDetails": "The vulnerability resides within the internal material connection testing APIs, specifically located at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test. The root cause is a deficiency in input validation and authorization checking during the processing of requests directed toward these endpoints. The application accepts a provided pipeline or configuration repository context without verifying if the requesting user possesses the necessary administrative authorization for the target resource.\nThe attack flow begins when an authenticated attacker, holding restricted privileges as a pipeline group administrator, sends a craftily constructed request to one of the vulnerable API endpoints. By supplying a target pipeline or material ID that exists outside the attacker's authorized administrative scope, the attacker forces the GoCD server to execute a connection test against that resource. \nIn versions 20.6.0 and later, the impact is further amplified by the integration with secret-management plugins. When the 'Test Connection' function is invoked, the server resolves placeholders and external references to fetch the credentials required to establish a connection to the source control material. Since the API lacks proper scoping, an attacker can coerce the system into resolving and utilizing global secrets or credentials managed by third-party secret providers that the attacker would otherwise be unauthorized to access. This can result in the exposure of sensitive credentials or the ability to probe network-accessible resources on behalf of the GoCD server.\nThe exploitation mechanism is purely logic-based and does not require complex memory corruption techniques. The attacker simply manipulates the JSON or URL-based parameters defining the 'material' or 'context' of the connection test. Because the server treats the request as a legitimate administrative action, it performs the full resolution cycle, including the instantiation of material connection parameters and the invocation of secret managers. This post-exploitation behavior allows an attacker to effectively bypass the intended security boundaries of the multi-tenancy model within GoCD, potentially accessing private repositories or cloud-based infrastructure credentials managed by the CI/CD platform."
}