CVE-2026-52743: GoCD Information Disclosure Vulnerability

CVE-2026-52743 Overview

CVE-2026-52743 is an Insecure Direct Object Reference [CWE-639] vulnerability in GoCD, an open-source continuous delivery server. The flaw resides in the internal /jobStatus.json API, which fails to validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. Any authenticated user can enumerate job IDs and retrieve status data for pipelines they have no permission to view. Exposed data includes job names, execution state, progress timestamps, assigned agent IP addresses, agent UUIDs, and associated stage and pipeline identifiers. Console output, artifacts, commands, variables, and configuration are not exposed. The issue is fixed in GoCD version 26.1.0.

Critical Impact
Authenticated users can bypass pipeline-level access controls to enumerate job metadata across the entire GoCD server, including agent network details useful for lateral movement reconnaissance.

Affected Products

GoCD server versions prior to 26.1.0
GoCD internal UI /jobStatus.json API endpoint
All GoCD deployments where multiple users share a server with segmented pipeline permissions

Discovery Timeline

2026-09-21 - CVE-2026-52743 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-52743

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference in the JobController handling the /jobStatus.json endpoint. GoCD assigns each job a numeric, server-generated identifier. When a client requests job status, the controller accepts the pipeline name, stage name, and job ID as parameters but does not verify that the supplied job ID actually belongs to the referenced pipeline and stage.

An authenticated user can substitute a guessed or enumerated job ID while supplying pipeline and stage names they legitimately access. The server returns the job data associated with the ID rather than enforcing the pipeline-authorization boundary. Because job IDs are sequential integers, enumeration is trivial.

The leaked metadata is limited in scope but operationally valuable. Agent IP addresses, UUIDs, timing data, and pipeline topology support reconnaissance for attackers seeking to map internal CI/CD infrastructure.

Root Cause

The root cause is missing authorization on an internal JSON endpoint. Authentication is enforced, but object-level access control is not applied to the jobId parameter. The fix in commit 07f9ffd16263e0f626c4b7c0fced1b1b854aab1a adds validation in JobController.java and JobInstance.java to confirm that the retrieved job matches the pipeline and stage supplied in the request.

Attack Vector

Exploitation requires a valid authenticated session on the GoCD server. The attacker sends crafted HTTP GET requests to /jobStatus.json with a pipeline and stage they can view plus an enumerated jobId. No user interaction and no privilege escalation are required beyond baseline authenticated access.

java

// Patch excerpt: server/src/main/java/com/thoughtworks/go/server/controller/JobController.java
 import com.thoughtworks.go.server.service.*;
 import com.thoughtworks.go.server.service.support.toggle.Toggles;
 import com.thoughtworks.go.server.util.ErrorHandler;
-import com.thoughtworks.go.util.json.JsonAware;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
// Source: https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a

java

// Patch excerpt: domain/src/main/java/com/thoughtworks/go/domain/JobInstance.java
             return new SingleJobInstance();
         }
     }
+
     public String getTitle() {
         return getIdentifier().buildLocatorForDisplay();
     }
// Source: https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a

Detection Methods for CVE-2026-52743

Indicators of Compromise

Sequential or high-volume GET requests to /jobStatus.json from a single authenticated session
Requests where the jobId parameter does not correlate with prior navigation to the referenced pipeline or stage
Access patterns that iterate through numeric job IDs in short time windows

Detection Strategies

Enable GoCD access logging and parse for unusual jobStatus.json request rates per user
Correlate authenticated user identity against the pipelines they are authorized to view, flagging mismatches
Baseline typical UI navigation flows and alert on direct API calls that skip normal pipeline browsing paths

Monitoring Recommendations

Forward GoCD server logs to a centralized SIEM for user-behavior analytics
Monitor outbound queries against the /jobStatus.json endpoint for enumeration signatures
Track new or unexpected user accounts that begin querying job metadata immediately after creation

How to Mitigate CVE-2026-52743

Immediate Actions Required

Upgrade GoCD to version 26.1.0 or later, which contains the authorization fix
Audit existing user accounts and revoke access for dormant or unnecessary identities
Review recent jobStatus.json request logs for signs of prior enumeration

Patch Information

The fix is included in GoCD 26.1.0, released via GitHub Release 26.1.0 and documented in GoCD Release Information 26.1.0. The underlying code change is available in GitHub Commit 07f9ffd and described in GitHub Security Advisory GHSA-2x6r-h7h3-wqc4.

Workarounds

Restrict network access to the GoCD server to trusted operator networks where feasible
Reduce the population of authenticated users to the minimum required for CI/CD operations
Segment sensitive pipelines onto a dedicated GoCD instance until the upgrade to 26.1.0 is completed

bash

# Upgrade example for a self-hosted GoCD server
# 1. Back up the GoCD config and database
tar -czf gocd-backup-$(date +%F).tgz /etc/go /var/lib/go-server

# 2. Stop the service, upgrade to 26.1.0, restart
sudo systemctl stop go-server
sudo apt-get update && sudo apt-get install go-server=26.1.0-*
sudo systemctl start go-server

# 3. Verify version
curl -s http://localhost:8153/go/api/version | jq .