CVE Feed

    Dashboard / CVE / CVE-2026-52744

    CVE-2026-52744

    GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.

    Published:Sep 23, 2026
    Last Modified:Sep 29, 2026
    EPS:Sep 23, 2026
    EPSS Score:0.00313
    CVSS Score:5.3

    Affected Products

    Vendor
    Gocd
    Product
    Gocd

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-55632 (CVSS 4.3) — GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for au…
    CVE-2026-52742 (CVSS 5.1) — GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose …
    CVE-2026-55870 (CVSS 2.3) — GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators…
    CVE-2026-55625 (CVSS 4.9) — GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /…
    CVE-2026-52740 (CVSS 5.3) — GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP metho…
    CVE-2026-55060 (CVSS 3.7) — GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does …
    CVE-2026-52741 (CVSS 7.5) — GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links…
    CVE-2026-68919 (CVSS 7) — GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malic…
    CVE-2026-52743 (CVSS 4.3) — GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not valida…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High