Executive brief
GoCD is a continuous delivery server that manages build pipelines and source control integration. Prior to version 26.1.0, the server could expose unencrypted usernames and passwords that administrators stored within source control URLs through read-only APIs available to authenticated users. An attacker with access to a pipeline could retrieve these embedded credentials, compromising source control accounts even though GoCD supports safer alternatives like dedicated credential fields.
Technical details
GoCD inconsistently applied URL masking across multiple read-only APIs, exposing the full material URL including embedded credentials (userinfo portion) to authenticated users. The vulnerability affects legacy configurations where credentials are embedded in source control material URLs rather than using dedicated password fields or secret management plugins. The fix migrates to using uriForDisplay instead of the raw URL, which masks sensitive information.
Affected products
- GoCD GoCD prior to 26.1.0
Timeline
- 2026-09-21: disclosed
- 2026-07-06: patched: Fixed in version 26.1.0