# CVE-2026-52744: GoCD authorization bypass in fetch-artifact API

Source: https://junglewise.ai/threats/cve-2026-52744-gocd-is-a-continuous-deliver-server-from-20-2-0-until-26-1-0-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-52744 · Severity: info · Published 2026-09-23

GoCD is a continuous delivery server that orchestrates software deployment pipelines. An authenticated user can access an internal API endpoint that reveals pipeline dependency information and artifact names they are not authorized to view through the normal UI, allowing information disclosure about other teams' pipeline configurations and infrastructure details.

Technologies: [ThoughtWorks GoCD](https://junglewise.ai/threats/technologies/thoughtworks-gocd). Vendors: [ThoughtWorks](https://junglewise.ai/threats/vendors/thoughtworks).

## Quick answers

**Is CVE-2026-52744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52744 being exploited in the wild.

**How severe is CVE-2026-52744?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** ThoughtWorks GoCD 20.2.0 to 26.0.0.

**Is there a fix for CVE-2026-52744?** A patch was published on 2026-07-06: Fixed in version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52744 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-52744?** Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /go/api/internal/pipelines/**/upstream endpoint in GoCD 20.2.0 to 26.1.0 lacks proper authorization checks, permitting authenticated users to enumerate upstream pipeline dependencies and retrieve plugin reference names. The vulnerability affects the read-only fetch-artifact auto-suggestion API; attackers cannot modify pipeline data. Authorization controls were added in version 26.1.0.

## Affected products

- ThoughtWorks GoCD 20.2.0 to 26.0.0

## Timeline

- 2026-09-23: disclosed
- 2026-07-06: patched: Fixed in version 26.1.0

## References

- [https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c](https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c)
- [https://github.com/gocd/gocd/releases/tag/26.1.0](https://github.com/gocd/gocd/releases/tag/26.1.0)

## Related threats

- [GoCD internal pipeline structure API information disclosure](https://junglewise.ai/threats/cve-2026-55632-gocd-is-a-continuous-deliver-server-from-20-2-0-until-26-1-0-the)
- [GoCD authorization bypass in material connection test APIs](https://junglewise.ai/threats/cve-2026-55625-gocd-is-a-continuous-deliver-server-from-16-1-0-until-26-1-0-the)
- [GoCD job status information disclosure via API validation bypass](https://junglewise.ai/threats/cve-2026-52743-gocd-is-a-continuous-deliver-server-prior-to-26-1-0-the-internal)
- [GoCD stored cross-site scripting in tracking tool links](https://junglewise.ai/threats/cve-2026-52741-gocd-is-a-continuous-deliver-server-from-18-3-0-until-26-1-0-gocd)