# CVE-2026-52743: GoCD job status information disclosure via API validation bypass

Source: https://junglewise.ai/threats/cve-2026-52743-gocd-is-a-continuous-deliver-server-prior-to-26-1-0-the-internal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-52743 · Severity: medium · CVSS 4.3 · Published 2026-09-21

GoCD is a continuous delivery automation server that manages software build and deployment pipelines. The /jobStatus.json API in versions prior to 26.1.0 allows authenticated users to bypass access controls and retrieve sensitive job status information they should not have permission to view, including job identifiers, execution state, agent IP addresses and UUIDs, and associated pipeline and stage names. This enables attackers to discover and monitor jobs across pipelines outside their authorized scope, potentially revealing infrastructure details and pipeline structure.

Technologies: [ThoughtWorks GoCD](https://junglewise.ai/threats/technologies/thoughtworks-gocd). Vendors: [ThoughtWorks](https://junglewise.ai/threats/vendors/thoughtworks).

## Quick answers

**Is CVE-2026-52743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52743 being exploited in the wild.

**How severe is CVE-2026-52743?** Medium severity, with a CVSS score of 4.3, published 21 September 2026.

**Which products and versions are affected?** ThoughtWorks GoCD prior to 26.1.0.

**Is there a fix for CVE-2026-52743?** A patch was published on 2026-07-06: Fix released in version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52743 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-52743?** Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /jobStatus.json API endpoint fails to validate that a requested server-assigned job ID belongs to the pipeline and stage specified in the API request. An authenticated attacker can enumerate job IDs and retrieve metadata for jobs in unauthorized pipelines through parameter tampering or ID guessing. The vulnerability requires authentication but does not require user interaction; console output, artifacts, commands, variables, and configuration details are not exposed. The issue is fixed in version 26.1.0 by improving validation logic during job status JSON retrieval.

## Affected products

- ThoughtWorks GoCD prior to 26.1.0

## Timeline

- 2026-09-21: disclosed
- 2026-07-06: patched: Fix released in version 26.1.0

## References

- [https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a](https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a)
- [https://github.com/gocd/gocd/releases/tag/26.1.0](https://github.com/gocd/gocd/releases/tag/26.1.0)

## Related threats

- [GoCD internal pipeline structure API information disclosure](https://junglewise.ai/threats/cve-2026-55632-gocd-is-a-continuous-deliver-server-from-20-2-0-until-26-1-0-the)
- [GoCD authorization bypass in fetch-artifact API](https://junglewise.ai/threats/cve-2026-52744-gocd-is-a-continuous-deliver-server-from-20-2-0-until-26-1-0-the)
- [GoCD authorization bypass in material connection test APIs](https://junglewise.ai/threats/cve-2026-55625-gocd-is-a-continuous-deliver-server-from-16-1-0-until-26-1-0-the)
- [GoCD stored cross-site scripting in tracking tool links](https://junglewise.ai/threats/cve-2026-52741-gocd-is-a-continuous-deliver-server-from-18-3-0-until-26-1-0-gocd)