# CVE-2026-58369: Woodpecker CI NULL pointer dereference in organization lookup API

Source: https://junglewise.ai/threats/cve-2026-58369-woodpecker-ci-null-pointer-dereference-in-organization-lookup-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-58369 · Severity: medium · CVSS 5.3 · Published 2026-06-30

Woodpecker, a continuous integration (CI) platform, contains a flaw in how it handles certain public web requests. An unauthenticated attacker can send repeated requests to a specific web address to cause the server to crash internally and generate large amounts of error data. While the server automatically restarts, this 'log flooding' can fill up server storage, increase operational costs, and hide evidence of other malicious activities.

Technologies: [Woodpecker CI](https://junglewise.ai/threats/technologies/woodpecker). Vendors: [Woodpecker CI](https://junglewise.ai/threats/vendors/woodpecker-ci).

## Quick answers

**Is CVE-2026-58369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58369 being exploited in the wild.

**How severe is CVE-2026-58369?** Medium severity, with a CVSS score of 5.3, published 30 June 2026.

**Which products and versions are affected?** Woodpecker CI before 3.15.0.

**Is there a fix for CVE-2026-58369?** A patch was published on 2026-05-27: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58369 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58369?** Check whether you run Woodpecker CI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Woodpecker CI versions prior to 3.15.0 register the '/api/orgs/lookup/*org_full_name' endpoint without authentication middleware. The 'LookupOrg' handler unconditionally dereferences the session user object (specifically 'user.ForgeID' via 'ForgeFromUser') to determine which forge to query. Because unauthenticated requests return a nil session user, this results in a NULL pointer dereference. While the 'gin' recovery middleware prevents a total service crash by recovering from the panic and returning an HTTP 500 error, each request generates a multi-line stack trace (approximately 37 lines). An unauthenticated remote attacker can exploit this to flood logs, exhaust disk space, and obscure legitimate audit trails. This issue was addressed in version 3.15.0.

## Affected products

- Woodpecker CI Woodpecker before 3.15.0

## Timeline

- 2026-05-27: patched: Fix merged into main branch
- 2026-05-28: advisory: Version 3.15.0 released
- 2026-06-30: disclosed: CVE published

## References

- [https://github.com/woodpecker-ci/woodpecker/commit/1fbacac3a43b75b6e5a0a40a4f720a0017c62010](https://github.com/woodpecker-ci/woodpecker/commit/1fbacac3a43b75b6e5a0a40a4f720a0017c62010)
- [https://github.com/woodpecker-ci/woodpecker/pull/6652](https://github.com/woodpecker-ci/woodpecker/pull/6652)
- [https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.15.0](https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.15.0)
- [https://www.vulncheck.com/advisories/woodpecker-unauthenticated-null-pointer-dereference-in-api-orgs-lookup-enables-log-flooding-denial-of-service](https://www.vulncheck.com/advisories/woodpecker-unauthenticated-null-pointer-dereference-in-api-orgs-lookup-enables-log-flooding-denial-of-service)