CVE-2026-61549: Woodpecker CI privilege escalation in Kubernetes backend

CVE-2026-61549 · Severity: high · CVSS 4 · Published 2026-09-15

A security vulnerability in Woodpecker CI's Kubernetes integration allows users with repository access to escalate their privileges. By specifying a custom service account for their automation tasks, an attacker could gain unauthorized access to sensitive credentials, API keys, and potentially take full control of the underlying Kubernetes cluster. This affects any organization using Woodpecker with Kubernetes to run their software build and deployment pipelines.

Technologies: github.com/woodpecker-ci/woodpecker (Go), go.woodpecker-ci.org/woodpecker (Go), go.woodpecker-ci.org/woodpecker/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-61549 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61549 being exploited in the wild.
How severe is CVE-2026-61549?
High severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
github.com/woodpecker-ci/woodpecker (Go) >= 1.0.0, <= 1.0.4, SEMVER:introduced=1.0.0, SEMVER:introduced=1.0.0,last_affected=1.0.4; go.woodpecker-ci.org/woodpecker (Go) SEMVER:introduced=0; go.woodpecker-ci.org/woodpecker/v2 (Go) <= 2.8.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.8.3; go.woodpecker-ci.org/woodpecker/v3 (Go) < 3.16.0, SEMVER:introduced=0,fixed=3.16.0.
Is there a fix for CVE-2026-61549?
Yes. go.woodpecker-ci.org/woodpecker/v3 (Go): upgrade to 3.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61549 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61549?
Check whether you run github.com/woodpecker-ci/woodpecker (Go), go.woodpecker-ci.org/woodpecker (Go), go.woodpecker-ci.org/woodpecker/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • go.woodpecker-ci.org/woodpecker/v3 (Go): upgrade to 3.16.0 or later
    go get go.woodpecker-ci.org/woodpecker/v3@v3.16.0

Technical details

A privilege escalation vulnerability exists in Woodpecker CI's Kubernetes backend. The `backend_options.kubernetes.serviceAccountName` pipeline option is passed directly to the Kubernetes pod specification without administrative gating or validation. An attacker with 'Push' permissions on a connected repository can specify a privileged ServiceAccount within the pipeline namespace. If a privileged account is available, the attacker can inherit its RBAC permissions, enabling secret exfiltration (e.g., database credentials, TLS certificates) or full cluster compromise. The issue is fixed in version 3.16.0.

Affected products

  • Woodpecker Woodpecker CI >= 1.0.0, < 3.16.0

Identifiers

  • CVE-2026-61549
  • GHSA-qf34-295c-26v8
  • GO-2026-5992

Timeline

  • 2026-07-01: disclosed: Initial disclosure to vendor
  • 2026-07-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.