Is CVE-2026-55632 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55632 being exploited in the wild.

How severe is CVE-2026-55632?

Medium severity, with a CVSS score of 4.3, published 23 September 2026.

Which products and versions are affected?

ThoughtWorks GoCD 20.2.0 through 26.0.x.

Is there a fix for CVE-2026-55632?

A patch was published on 2026-06-15: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55632 attacked?

It is attacked over the network.

Am I affected by CVE-2026-55632?

Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55632: GoCD internal pipeline structure API information disclosure

CVE-2026-55632 · Severity: medium · CVSS 4.3 · Published 2026-09-23

GoCD is a continuous delivery server used to automate software build and deployment pipelines. An authentication bypass in its pipeline configuration autocompletion API allowed lower-privileged users to enumerate usernames and role names without administrator access, potentially facilitating targeted attacks. The vulnerability does not expose which roles are assigned to users or allow data modification, but increases attack surface for credential-based attacks.

Technologies: ThoughtWorks GoCD. Vendors: ThoughtWorks.

Quick answers

Is CVE-2026-55632 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55632 being exploited in the wild.
How severe is CVE-2026-55632?: Medium severity, with a CVSS score of 4.3, published 23 September 2026.
Which products and versions are affected?: ThoughtWorks GoCD 20.2.0 through 26.0.x.
Is there a fix for CVE-2026-55632?: A patch was published on 2026-06-15: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55632 attacked?: It is attacked over the network.
Am I affected by CVE-2026-55632?: Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The internal pipeline structure API endpoint used for autocompletion returned user and role data to any authenticated user instead of restricting access to administrators. An attacker with any valid authentication could enumerate configured usernames and available role names by querying the endpoint during pipeline, template, environment, or user-preference configuration editing. The endpoint is read-only and does not reveal role assignments, limiting immediate impact but enabling reconnaissance for privilege escalation or social engineering attacks.

Affected products

ThoughtWorks GoCD 20.2.0 through 26.0.x

Timeline

2026-09-23: disclosed: CVE-2026-55632 published
2026-06-15: patched: Fix committed to repository
2026-07-06: patched: Version 26.1.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.