Executive brief
Woodpecker, a continuous integration (CI) engine, contains a security flaw in how it handles code contributions from GitLab. An attacker can bypass the required security approval process for new code by spoofing a trusted user's name in a commit. This allows unauthorized code to run automatically on company infrastructure, potentially leading to the theft of sensitive credentials or secrets used in the software building process.
Technical details
In Woodpecker versions prior to 3.15.0, the GitLab forge driver populates the 'pipeline.Author' field using the 'commit.author.name' value from incoming webhook payloads. Because GitLab does not verify this specific field and Woodpecker matches it directly against the 'ApprovalAllowedUsers' bypass list, an attacker can craft a commit with a name matching a trusted user. This causes the 'needsApproval' check to return false, allowing the execution of arbitrary pipeline steps on a Woodpecker agent. This bypass is specific to the GitLab driver; other drivers like GitHub and Gitea use validated actor identities. The issue is resolved in version 3.15.0 by switching to the validated GitLab username.
Affected products
- woodpecker-ci Woodpecker < 3.15.0
Timeline
- 2026-05-27: patched: Fix merged via Pull Request #6653
- 2026-05-28: advisory: Release v3.15.0 published
- 2026-06-30: disclosed: CVE-2026-58370 published
References
- https://github.com/woodpecker-ci/woodpecker/commit/98faae778c953678944996c89ed99307d2f16a3d
- https://github.com/woodpecker-ci/woodpecker/pull/6653
- https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.15.0
- https://www.vulncheck.com/advisories/woodpecker-gitlab-approval-gate-bypass-via-spoofable-commit-author-name