CVE-2026-55060: GoCD Authorization Bypass Vulnerability

CVE-2026-55060 Overview

CVE-2026-55060 is a broken authorization vulnerability [CWE-863] affecting GoCD, a continuous delivery server. The /go/api/support/process_list endpoint fails to enforce administrator-only authorization from version 13.1.0 through 26.1.0. Any authenticated internal user can query the endpoint while source control child processes execute. The response exposes command-line arguments, usernames, remote material URLs, and internal material paths for repositories the user cannot otherwise access. Credentials, environment variables, and user-defined secrets remain masked. The issue is fixed in version 26.1.0.

Critical Impact
Authenticated non-admin users can enumerate source control material paths, remote repository URLs, and process command-line arguments they would not normally be authorized to view.

Affected Products

GoCD versions 13.1.0 through 26.0.x
GoCD /go/api/support/process_list endpoint
GoCD AuthorizeFilterChain configuration for /api/support routes

Discovery Timeline

2026-09-21 - CVE-2026-55060 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-55060

Vulnerability Analysis

The vulnerability stems from an incomplete URL pattern in the GoCD authorization filter chain. The filter registered an authority requirement for the exact path /api/support but did not cover sub-paths such as /api/support/process_list. As a result, requests to the support process list endpoint bypassed the ROLE_SUPERVISOR requirement and were reachable by any authenticated user.

When source control child processes are active, the endpoint returns process metadata including command-line arguments. Attackers can observe remote material URLs, internal filesystem paths, and OS usernames tied to pipelines and materials they are not authorized to see. Exploitation requires timing the query to coincide with running child processes, which makes attacks opportunistic rather than deterministic. Sensitive values such as credentials, environment variables, and user-defined secrets are masked or omitted by the process representer.

Root Cause

The root cause is an authorization misconfiguration in AuthorizeFilterChain.java. The chain declared /api/support (exact match) as requiring ROLE_SUPERVISOR instead of /api/support/**. Sub-resources under the support namespace inherited only the default authenticated-user filter, exposing administrative telemetry to standard users.

Attack Vector

Exploitation requires network access to the GoCD server and valid credentials for any internal user account. The attacker issues repeated authenticated HTTP GET requests to /go/api/support/process_list and inspects responses for source control process entries. Success depends on unpredictable process timing, since data is only exposed while a material check-out or update process is running.

java

// Patch: server/src/main/java/com/thoughtworks/go/server/newsecurity/filterchains/AuthorizeFilterChain.java
// The filter pattern was widened from an exact match to a recursive pattern
// so that all sub-paths under /api/support require ROLE_SUPERVISOR.

// blanket role that requires supervisor access by default (often due to use by older admin APIs)
.addAuthorityFilterChain("/api/admin/**", apiAccessDeniedHandler, ROLE_SUPERVISOR)
.addAuthorityFilterChain("/api/config-repository.git/**", apiAccessDeniedHandler, ROLE_SUPERVISOR)
-.addAuthorityFilterChain("/api/support", apiAccessDeniedHandler, ROLE_SUPERVISOR)
+.addAuthorityFilterChain("/api/support/**", apiAccessDeniedHandler, ROLE_SUPERVISOR)

// any other APIs require `ROLE_USER`
.addAuthorityFilterChain("/cctray.xml", apiAccessDeniedHandler, ROLE_USER)
// Source: https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8

Detection Methods for CVE-2026-55060

Indicators of Compromise

Repeated authenticated HTTP GET requests to /go/api/support/process_list from non-administrator accounts.
Access log entries showing successful 200 responses to /api/support/* sub-paths for users lacking ROLE_SUPERVISOR.
Polling patterns from a single user or IP against the support endpoint over extended time windows.

Detection Strategies

Correlate GoCD access logs with role assignments to flag any non-admin user reaching /api/support/**.
Alert on high-frequency polling of process_list that suggests attempts to catch transient child process data.
Baseline normal administrator use of the support API and treat deviations as suspicious enumeration attempts.

Monitoring Recommendations

Forward GoCD reverse proxy or application logs to a centralized log platform for retention and query.
Track authentication context alongside request URLs so authorization decisions can be audited retroactively.
Monitor for new or unexpected user accounts probing internal-only API namespaces.

How to Mitigate CVE-2026-55060

Immediate Actions Required

Upgrade GoCD to version 26.1.0 or later, which enforces ROLE_SUPERVISOR on all /api/support/** routes.
Audit GoCD user accounts and remove or downgrade unnecessary internal user access.
Review historical access logs for prior queries to /go/api/support/process_list by non-admin users.

Patch Information

The fix is delivered in GoCD Release 26.1.0. The corrective change is in commit fbf832f, which widens the authorization filter pattern from /api/support to /api/support/** and adds validation in ApiSupportController. Additional context is available in the GitHub Security Advisory GHSA-vqjf-7pf8-hgwr and the GoCD 26.1.0 release notes.

Workarounds

Restrict network access to the GoCD server so only trusted administrators can reach the API surface.
Place a reverse proxy in front of GoCD that blocks unauthenticated and non-admin requests to /go/api/support/**.
Reduce the number of internal user accounts and rotate credentials suspected of exposure.

bash

# Example NGINX reverse proxy rule to block support API sub-paths
# Applies until GoCD is upgraded to 26.1.0
location ~ ^/go/api/support(/|$) {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://gocd_backend;
}