# CVE-2026-55625: GoCD authorization bypass in material connection test APIs

Source: https://junglewise.ai/threats/cve-2026-55625-gocd-is-a-continuous-deliver-server-from-16-1-0-until-26-1-0-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-55625 · Severity: medium · CVSS 4.9 · Published 2026-09-21

GoCD is a continuous delivery server that orchestrates automated software pipelines. Versions 16.1.0 through 25.4.0 contain an authorization flaw in the material connection test APIs that allows a pipeline group administrator to test connections to source control materials outside their authorized groups and potentially extract credentials stored in those materials, including external secrets managed by plugins in GoCD 20.6.0 and later.

Technologies: [ThoughtWorks GoCD](https://junglewise.ai/threats/technologies/thoughtworks-gocd). Vendors: [ThoughtWorks](https://junglewise.ai/threats/vendors/thoughtworks).

## Quick answers

**Is CVE-2026-55625 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55625 being exploited in the wild.

**How severe is CVE-2026-55625?** Medium severity, with a CVSS score of 4.9, published 21 September 2026.

**Which products and versions are affected?** ThoughtWorks GoCD 16.1.0 to 25.4.0.

**Is there a fix for CVE-2026-55625?** A patch was published on 2026-07-06: Fixed in version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55625 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55625?** Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test endpoints, which accept arbitrary pipeline and pipeline-group context parameters without sufficient authorization validation. An authenticated pipeline group administrator can supply a context from another pipeline group to access and test materials they should not have permission to access, potentially harvesting stored credentials. In GoCD 20.6.0+, the test context resolves external secrets managed by secret-management plugins, including global reusable secrets with separate permissions.

## Affected products

- ThoughtWorks GoCD 16.1.0 to 25.4.0

## Timeline

- 2026-09-21: disclosed
- 2026-07-06: patched: Fixed in version 26.1.0

## References

- [https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918](https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918)
- [https://github.com/gocd/gocd/releases/tag/26.1.0](https://github.com/gocd/gocd/releases/tag/26.1.0)

## Related threats

- [GoCD internal pipeline structure API information disclosure](https://junglewise.ai/threats/cve-2026-55632-gocd-is-a-continuous-deliver-server-from-20-2-0-until-26-1-0-the)
- [GoCD authorization bypass in fetch-artifact API](https://junglewise.ai/threats/cve-2026-52744-gocd-is-a-continuous-deliver-server-from-20-2-0-until-26-1-0-the)
- [GoCD job status information disclosure via API validation bypass](https://junglewise.ai/threats/cve-2026-52743-gocd-is-a-continuous-deliver-server-prior-to-26-1-0-the-internal)
- [GoCD stored cross-site scripting in tracking tool links](https://junglewise.ai/threats/cve-2026-52741-gocd-is-a-continuous-deliver-server-from-18-3-0-until-26-1-0-gocd)