CVE Feed

    Dashboard / CVE / CVE-2026-52743

    CVE-2026-52743

    GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

    Published:Sep 21, 2026
    Last Modified:Sep 25, 2026
    EPS:Sep 21, 2026
    EPSS Score:0.00342
    CVSS Score:4.3

    Affected Products

    Vendor
    Gocd
    Product
    Gocd

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-55632 (CVSS 4.3) — GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for au…
    CVE-2026-52744 (CVSS 5.3) — GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-sugges…
    CVE-2026-52742 (CVSS 5.1) — GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose …
    CVE-2026-55870 (CVSS 2.3) — GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators…
    CVE-2026-55625 (CVSS 4.9) — GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /…
    CVE-2026-52740 (CVSS 5.3) — GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP metho…
    CVE-2026-55060 (CVSS 3.7) — GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does …
    CVE-2026-52741 (CVSS 7.5) — GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links…
    CVE-2026-68919 (CVSS 7) — GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High