CVE-2026-52742: GoCD Information Disclosure Vulnerability

CVE-2026-52742 Overview

GoCD, a widely deployed continuous delivery server, exposes historical full server configuration through legacy routes under /go/admin/restful/*. The vulnerability affects versions from 12.3.1 until 26.1.0. Pipeline group administrators receive the entire server configuration instead of responses scoped to the groups they administer. Disclosed data can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists. A malicious pipeline group administrator can leverage disclosed agent registration data to connect a rogue compatible agent. This creates a higher-complexity path to receiving work or overwriting artifacts belonging to other groups. The issue is fixed in version 26.1.0 and is tracked as an authorization flaw [CWE-863].

Critical Impact
Pipeline group administrators can retrieve full server configuration, including agent registration keys and encrypted credentials, enabling cross-group artifact tampering via rogue agent registration.

Affected Products

GoCD versions from 12.3.1 up to (but not including) 26.1.0
Deployments that allow pipeline editing by pipeline group administrators
Instances exposing legacy /go/admin/restful/* routes

Discovery Timeline

2026-09-21 - CVE-2026-52742 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-52742

Vulnerability Analysis

The vulnerability is an authorization flaw in GoCD's legacy configuration endpoints. Routes under /go/admin/restful/* were designed for full administrators but remained reachable by pipeline group administrators. Instead of scoping responses to the requesting user's authorized groups, the endpoint returns the complete server configuration document.

The returned configuration contains sensitive material well beyond pipeline definitions. This includes agent auto-registration keys, webhook invocation keys, encrypted material credentials, and the GoCD administrator roster. Normal authenticated users cannot reach the endpoint, and the endpoint does not modify server state, so integrity impact is limited to downstream misuse of disclosed secrets.

Root Cause

The root cause is missing per-group authorization enforcement on legacy read endpoints. The legacy restful controller returned the global configuration object rather than filtering it against the caller's pipeline group permissions. This mismatch between the caller's role and the response scope is a classic broken authorization defect [CWE-863]. Deployments that restrict pipeline editing to full administrators or configuration repositories are not affected because pipeline group administrators cannot access the vulnerable path in those configurations.

Attack Vector

An authenticated pipeline group administrator issues a request to a legacy /go/admin/restful/* route. The server responds with the full configuration. The attacker extracts the agent auto-registration key and registers a rogue agent compatible with resources used by other pipeline groups. Once the rogue agent receives work, the attacker can influence build execution or overwrite artifacts associated with groups outside their administrative scope.

java

// Patch excerpt from base/src/main/java/com/thoughtworks/go/remote/StandardHeaders.java
 package com.thoughtworks.go.remote;
 
 public interface StandardHeaders {
-    String REQUEST_ARTIFACT_PAYLOAD_SIZE = "X-Go-Artifact-Size";
+    String REQUEST_ARTIFACT_PAYLOAD_SIZE_BYTES = "X-Go-Artifact-Size";
     String REQUEST_CONFIRM_MODIFICATION_DEPRECATED = "Confirm";
     String REQUEST_CONFIRM_MODIFICATION = "X-GoCD-Confirm";

Source: GitHub Commit 8be3a67. The commit removes old and little-used configuration APIs, including the legacy editing paths that exposed full configuration data.

Detection Methods for CVE-2026-52742

Indicators of Compromise

Authenticated HTTP requests to /go/admin/restful/* paths from accounts that are not full GoCD administrators.
New agent registrations shortly after access to legacy admin endpoints, especially agents whose resource tags overlap with other groups' pipelines.
Unexpected modifications or overwrites of build artifacts across pipeline groups that share resources.

Detection Strategies

Enable access logging on the GoCD reverse proxy and alert on any GET requests to /go/admin/restful/*.
Correlate legacy endpoint access with the requesting user's role; any non-administrator hitting these routes is suspicious.
Baseline the set of known agent auto-registration events and alert on registrations from unexpected hosts or subnets.

Monitoring Recommendations

Forward GoCD server and reverse-proxy logs to a centralized analytics platform for correlation.
Monitor the GoCD audit trail for reads of full configuration and for agent registration events tied to shared resources.
Track pipeline artifact checksums between builds to detect unauthorized artifact overwrites.

How to Mitigate CVE-2026-52742

Immediate Actions Required

Upgrade GoCD to version 26.1.0, which removes the legacy /go/admin/restful/* endpoints and associated configuration exposure.
Rotate agent auto-registration keys, webhook invocation keys, and any credentials stored as encrypted materials that may have been disclosed.
Audit registered agents and remove any that were not provisioned by full administrators.
Review recent artifact publishing activity for cross-group tampering.

Patch Information

The fix is delivered in GoCD Release 26.1.0. Technical details are available in the GitHub Security Advisory, the merged pull request #14398, and the upstream commit. Release notes are published at the GoCD 26.1.0 release page.

Workarounds

Restrict pipeline editing to full GoCD administrators or move pipeline configuration into configuration repositories; these deployment modes are not affected.
Block /go/admin/restful/* at a reverse proxy for all non-administrator accounts until the upgrade is applied.
Reduce the number of pipeline group administrators to trusted personnel only during the remediation window.

bash

# nginx reverse-proxy example: block legacy restful admin routes
location ~ ^/go/admin/restful/ {
    deny all;
    return 403;
}