Executive brief
GoCD is a continuous delivery server that orchestrates automated software pipelines. Versions 16.1.0 through 25.4.0 contain an authorization flaw in the material connection test APIs that allows a pipeline group administrator to test connections to source control materials outside their authorized groups and potentially extract credentials stored in those materials, including external secrets managed by plugins in GoCD 20.6.0 and later.
Technical details
The vulnerability exists in the /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test endpoints, which accept arbitrary pipeline and pipeline-group context parameters without sufficient authorization validation. An authenticated pipeline group administrator can supply a context from another pipeline group to access and test materials they should not have permission to access, potentially harvesting stored credentials. In GoCD 20.6.0+, the test context resolves external secrets managed by secret-management plugins, including global reusable secrets with separate permissions.
Affected products
- ThoughtWorks GoCD 16.1.0 to 25.4.0
Timeline
- 2026-09-21: disclosed
- 2026-07-06: patched: Fixed in version 26.1.0