Executive brief
A security vulnerability in Woodpecker CI's Kubernetes integration allows users with repository access to escalate their privileges. By specifying a custom service account for their automation tasks, an attacker could gain unauthorized access to sensitive credentials, API keys, and potentially take full control of the underlying Kubernetes cluster. This affects any organization using Woodpecker with Kubernetes to run their software build and deployment pipelines.
Technical details
A privilege escalation vulnerability exists in Woodpecker CI's Kubernetes backend. The `backend_options.kubernetes.serviceAccountName` pipeline option is passed directly to the Kubernetes pod specification without administrative gating or validation. An attacker with 'Push' permissions on a connected repository can specify a privileged ServiceAccount within the pipeline namespace. If a privileged account is available, the attacker can inherit its RBAC permissions, enabling secret exfiltration (e.g., database credentials, TLS certificates) or full cluster compromise. The issue is fixed in version 3.16.0.
Affected products
- Woodpecker Woodpecker CI >= 1.0.0, < 3.16.0
Timeline
- 2026-07-01: disclosed: Initial disclosure to vendor
- 2026-07-14: advisory: GitHub Advisory published
References
- https://api.github.com/users/AnuragBathani
- https://github.com/AnuragBathani
- https://api.github.com/users/AnuragBathani/gists%7B/gist_id%7D
- https://api.github.com/users/AnuragBathani/repos
- https://avatars.githubusercontent.com/u/105292506?v=4
- https://api.github.com/users/AnuragBathani/events%7B/privacy%7D