CVE-2026-52744: GoCD Information Disclosure Vulnerability

CVE-2026-52744 Overview

GoCD is a continuous delivery server used to model and orchestrate build and deployment pipelines. CVE-2026-52744 is a missing authorization vulnerability [CWE-862] in the internal fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream. The endpoint fails to enforce access controls on upstream dependency data. An authenticated user can enumerate inter-pipeline dependency hierarchies and retrieve pipeline, stage, job, and artifact plugin reference names that the user is not authorized to view in the GoCD UI. The issue affects GoCD releases from 20.2.0 up to but not including 26.1.0 and is fixed in version 26.1.0.

Critical Impact
Any authenticated GoCD user can enumerate the names and dependency structure of pipelines, stages, jobs, and artifacts they are not permitted to see, exposing internal build topology to unauthorized principals.

Affected Products

GoCD versions 20.2.0 through 26.0.x
GoCD internal API endpoint /go/api/internal/pipelines/**/upstream
Fixed in GoCD 26.1.0

Discovery Timeline

2026-09-23 - CVE-2026-52744 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database
26.1.0 - GoCD releases fixed version, see GitHub Release 26.1.0

Technical Details for CVE-2026-52744

Vulnerability Analysis

GoCD exposes an internal REST endpoint used by the UI to power auto-suggestions when configuring fetch-artifact tasks. The endpoint returns the set of upstream pipelines, stages, jobs, and artifact plugin references that a given pipeline depends on. This data is derived from the global pipeline dependency graph.

The endpoint performs authentication but does not filter results based on the caller's per-pipeline authorization. As a result, an authenticated GoCD user who has permission to one pipeline can request upstream metadata for pipelines they do not have read access to. The response leaks pipeline, stage, job, and artifact plugin reference names, along with the shape of the upstream dependency graph.

The vulnerability is read-only. The endpoint does not permit modification of pipeline data or execution of arbitrary code. Impact is limited to disclosure of build topology and naming information that operators typically expect to be gated by GoCD's role-based pipeline permissions.

Root Cause

The root cause is a missing authorization check [CWE-862] on the InternalDependencyPipelinesControllerV1 endpoint backing fetch-artifact auto-suggestions. The controller returned dependency data derived from the full pipeline graph without applying the caller's view permissions. The upstream fix in commit ce9602d reworks the auto-suggestion logic and removes the legacy go.fetch-artifact.auto-suggest and go.fetch-artifact.template.auto-suggest toggles that gated the prior behavior.

Attack Vector

Exploitation requires only a valid GoCD user session. The attacker sends an HTTP GET request to /go/api/internal/pipelines/<pipeline>/upstream and parses the JSON response for pipeline, stage, job, and artifact plugin reference names outside their authorized scope.

java

// Security patch excerpt: InternalDependencyPipelinesControllerV1.java
 import com.thoughtworks.go.spark.GlobalExceptionMapper;
 import com.thoughtworks.go.spark.Routes;
 import com.thoughtworks.go.spark.spring.SparkSpringController;
-import com.thoughtworks.go.util.SystemEnvironment;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 import spark.Request;

// SystemEnvironment.java: auto-suggest feature toggles removed
-    public static final GoSystemProperty<Boolean> FETCH_ARTIFACT_AUTO_SUGGEST = new GoBooleanSystemProperty("go.fetch-artifact.auto-suggest", true);
-    public static final GoSystemProperty<Boolean> GO_FETCH_ARTIFACT_TEMPLATE_AUTO_SUGGEST = new GoBooleanSystemProperty("go.fetch-artifact.template.auto-suggest", true);

Source: GitHub Commit ce9602d

Detection Methods for CVE-2026-52744

Indicators of Compromise

HTTP GET requests to /go/api/internal/pipelines/**/upstream from user accounts that do not have UI access to the referenced pipeline.
Unusual volume or breadth of requests against the internal dependency-pipelines endpoint originating from a single authenticated session.
Requests to the endpoint from automated clients or scripts rather than a browser-driven pipeline configuration workflow.

Detection Strategies

Correlate GoCD access logs against the GoCD role and pipeline-group authorization model to flag callers requesting upstream data for pipelines outside their permitted set.
Alert on authenticated API access to /go/api/internal/* endpoints from non-browser user agents or from service accounts not used by the UI.
Baseline typical fetch-artifact configuration workflows and flag statistical outliers in the rate or diversity of pipelines queried per user.

Monitoring Recommendations

Forward GoCD server access logs and authentication events to a centralized log platform for retention and correlation.
Enable auditing on GoCD user accounts with broad login rights but narrow pipeline access to detect enumeration behavior.
Track the GoCD server version across environments and alert when instances remain on releases prior to 26.1.0.

How to Mitigate CVE-2026-52744

Immediate Actions Required

Upgrade all GoCD servers to version 26.1.0 or later, published on the GoCD Release Page 26.1.0.
Review GoCD user accounts and remove or downgrade accounts that no longer require access, reducing the pool of principals that can reach authenticated internal APIs.
Audit recent access logs for requests to /go/api/internal/pipelines/**/upstream and assess whether sensitive pipeline names were exposed.

Patch Information

The fix is included in GoCD 26.1.0. The upstream commit ce9602d reworks the fetch-artifact auto-suggestion logic and removes the legacy FETCH_ARTIFACT_AUTO_SUGGEST and GO_FETCH_ARTIFACT_TEMPLATE_AUTO_SUGGEST system properties. See the GitHub Security Advisory GHSA-mvpm-hmc9-2q8p and GitHub Commit ce9602d for details.

Workarounds

Restrict network access to the GoCD server so only trusted operators can authenticate to the web UI and API.
Place GoCD behind a reverse proxy that blocks or rate-limits requests to /go/api/internal/* from non-UI clients until the upgrade is applied.
Rotate or disable low-trust GoCD accounts and API tokens to reduce the number of principals capable of reaching the vulnerable endpoint.

bash

# Example NGINX snippet to restrict the vulnerable internal endpoint pre-patch
location ~ ^/go/api/internal/pipelines/.*/upstream$ {
    allow 10.0.0.0/8;      # trusted operator network
    deny  all;
    proxy_pass http://gocd_backend;
}