Executive brief
GoCD is a continuous delivery server that orchestrates software build and deployment pipelines. Legacy REST API endpoints exposed full server configuration including encryption keys and administrator credentials to pipeline group administrators who should only access their own group's settings. A malicious pipeline group administrator could exploit this to obtain agent registration keys and potentially deploy unauthorized code through rogue agents.
Technical details
Authorization bypass in /go/admin/restful/* legacy endpoints fails to restrict configuration responses to the specific pipeline groups a user administers, instead returning the full historical server configuration. The vulnerability affects authenticated administrators with pipeline group permissions and is remotely exploitable. Attackers gain exposure to agent auto-registration keys, webhook keys, encrypted credentials, and administrator lists; the fix removes these legacy APIs entirely in version 26.1.0.
Affected products
- JetBrains GoCD 12.3.1 to 25.4.0
Timeline
- 2026-09-21: disclosed: CVE-2026-52742 disclosed
- 2026-06-04: patched: Fix merged in commit 8be3a67; released in version 26.1.0