Is CVE-2026-55870 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55870 being exploited in the wild.

How severe is CVE-2026-55870?

Informational severity, published 21 September 2026.

Is there a fix for CVE-2026-55870?

A patch was published on 2026-07-06: Fixed in version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55870 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55870?

Check whether you run GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55870: GoCD credential disclosure through read-only APIs

CVE-2026-55870 · Severity: info · Published 2026-09-21

GoCD is a continuous delivery server that manages build pipelines and source control integration. Prior to version 26.1.0, the server could expose unencrypted usernames and passwords that administrators stored within source control URLs through read-only APIs available to authenticated users. An attacker with access to a pipeline could retrieve these embedded credentials, compromising source control accounts even though GoCD supports safer alternatives like dedicated credential fields.

Technologies: GoCD. Vendors: GoCD.

Quick answers

Is CVE-2026-55870 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55870 being exploited in the wild.
How severe is CVE-2026-55870?: Informational severity, published 21 September 2026.
Which products and versions are affected?: GoCD prior to 26.1.0.
Is there a fix for CVE-2026-55870?: A patch was published on 2026-07-06: Fixed in version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55870 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55870?: Check whether you run GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GoCD inconsistently applied URL masking across multiple read-only APIs, exposing the full material URL including embedded credentials (userinfo portion) to authenticated users. The vulnerability affects legacy configurations where credentials are embedded in source control material URLs rather than using dedicated password fields or secret management plugins. The fix migrates to using uriForDisplay instead of the raw URL, which masks sensitive information.

Affected products

GoCD GoCD prior to 26.1.0

Timeline

2026-09-21: disclosed
2026-07-06: patched: Fixed in version 26.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.