CVE-2026-52740: GoCD Template Config Auth Bypass Vulnerability

CVE-2026-52740 Overview

GoCD, a continuous delivery server, contains an authorization bypass vulnerability in the Get Template Config API. The flaw exists in versions from 18.7.0 until 26.1.0. The API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission. This exposes template configuration data to users who should not have read access. The issue is categorized under [CWE-863] Incorrect Authorization and is fixed in version 26.1.0.

Critical Impact

Authenticated users with low privileges can bypass view permissions on pipeline templates by manipulating HTTP method capitalization, disclosing template configuration to unauthorized principals.

Affected Products

• GoCD versions 18.7.0 through 26.0.x
• GoCD deployments where the reverse proxy accepts non-uppercase HTTP methods
• GoCD Get Template Config API endpoint

Discovery Timeline

• 2026-09-21 - CVE-2026-52740 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-52740

Vulnerability Analysis

The vulnerability resides in GoCD's API authorization filter selection logic. The framework matches HTTP method strings using case-sensitive string comparison rather than normalized enum values. An attacker sends a request with a method such as Get or get instead of GET. The authorization filter registered for GET does not match, so the required view permission check is skipped. The underlying handler still processes the request and returns the pipeline template configuration.

API operations that modify data are not affected by this bypass. Secure variables within templates remain encrypted at rest and are not exposed in cleartext. Deployments fronted by a reverse proxy that rejects or normalizes non-uppercase HTTP methods are also protected from exploitation.

Root Cause

The root cause is inconsistent handling of the HTTP method identifier during filter registration and dispatch. Filters were keyed on raw method strings rather than the spark.route.HttpMethod enumeration. This allowed a mismatch between the method used to select the authorization filter and the method used to dispatch the handler.

Attack Vector

An authenticated attacker with a valid but low-privileged account issues an HTTP request to the Get Template Config endpoint. The request uses a method token with mixed or lowercase characters. The server bypasses the view-permission filter and returns the template configuration in the response body.

// Patch excerpt: api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java
 import spark.Filter;
 import spark.Request;
 import spark.Response;
+import spark.route.HttpMethod;
 
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.Collections;
+import java.util.EnumSet;
 import java.util.Map;
-import java.util.Set;

Source: GitHub Commit 614d694

The patch replaces string-based method matching with the type-safe HttpMethod enum, ensuring the authorization filter matches the dispatched method regardless of capitalization.

// Patch excerpt: NotificationFilterControllerV2.java
 import org.springframework.stereotype.Component;
 import spark.Request;
 import spark.Response;
+import spark.route.HttpMethod;

Source: GitHub Commit 614d694

Detection Methods for CVE-2026-52740

Indicators of Compromise

• HTTP access logs containing requests to /go/api/admin/templates/* with method tokens in mixed or lowercase (Get, get, gEt).
• Successful 200 OK responses to template configuration endpoints from user accounts lacking view permission on those templates.
• Unexpected read activity on pipeline templates originating from low-privilege service or user accounts.

Detection Strategies

• Parse reverse proxy or GoCD access logs and flag any request where the HTTP method is not fully uppercase.
• Correlate template-read API responses against the requesting user's role assignments to detect access without corresponding permission grants.
• Alert on repeated variations of HTTP method casing from a single source, which suggests probing for the bypass.

Monitoring Recommendations

• Enable verbose API access logging on GoCD and forward logs to a centralized analytics platform for retention and search.
• Monitor the /api/admin/templates endpoint family for anomalous request patterns and unexpected user agents.
• Track user-to-template access baselines and alert on deviations that indicate horizontal information disclosure.

How to Mitigate CVE-2026-52740

Immediate Actions Required

• Upgrade GoCD to version 26.1.0 or later, which contains the fix for case-insensitive HTTP method matching.
• Audit access logs for prior requests using non-uppercase HTTP methods against template endpoints.
• Review pipeline template contents that may have been disclosed and rotate any sensitive non-encrypted values referenced in them.

Patch Information

The fix is delivered in GoCD 26.1.0. The corrective commit refactors HTTP method handling to use the spark.route.HttpMethod enum, enforcing type-safe comparisons. See the GitHub Security Advisory GHSA-9jfm-4f6v-79wh, the GitHub Release 26.1.0, and the GoCD Release Information 26.1.0.

Workarounds

• Place GoCD behind a reverse proxy configured to reject or normalize HTTP requests whose method token is not fully uppercase.
• Restrict network access to the GoCD API to trusted administrative networks until the upgrade is applied.
• Review and tighten role-based access assignments so that low-privilege accounts do not have broad authentication access to the API surface.

# Example nginx configuration to reject non-uppercase HTTP methods
if ($request_method !~ ^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$) {
    return 405;
}