CVE-2026-55625: GoCD Information Disclosure Vulnerability

CVE-2026-55625 Overview

CVE-2026-55625 is an authorization flaw in GoCD, a continuous delivery server. The vulnerability affects internal material connection test endpoints at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test. These APIs accept arbitrary existing pipeline and pipeline-group contexts without sufficient validation. A pipeline group administrator can invoke Test Connection against source control materials outside their authorized scope. The issue affects GoCD versions from 16.1.0 until 26.1.0 and is classified as an Authorization Bypass Through User-Controlled Key [CWE-639].

Critical Impact
A pipeline group admin can trigger connection tests against materials they do not own and, in GoCD 20.6.0 and later, resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions.

Affected Products

GoCD versions 16.1.0 through 26.0.x
GoCD 20.6.0 and later (additional secret-resolution exposure)
GoCD server internal material test APIs

Discovery Timeline

2026-09-21 - CVE-2026-55625 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-55625

Vulnerability Analysis

The flaw resides in two internal REST endpoints used to test source control material connectivity. Both endpoints accept a pipeline name and pipeline-group name from the caller. The server uses that supplied context to resolve credentials and secrets during the connection test. The authorization check confirms only that the caller is an administrator of some pipeline group, not of the supplied one. This lets a lower-privileged pipeline group admin borrow a foreign context and probe materials belonging to other groups or configuration repositories.

Root Cause

The root cause is user-controlled context resolution without a matching authorization decision [CWE-639]. The endpoints treat the client-supplied pipeline and group identifiers as trusted keys. From GoCD 20.6.0 onward the same context is passed to secret-management plugins, so global reusable secrets protected by separate permissions can be resolved during the test. The fix in version 26.1.0 reworks material connection and pipeline group admin testing to constrain context to what the caller may access.

Attack Vector

Exploitation requires an authenticated pipeline group administrator account. The attacker sends a crafted request to the material test API supplying a pipeline and group they do not administer. The server returns whether the connection succeeded and, depending on plugin behavior, may expose sensitive information through the resolved secrets or credentials. No user interaction is required.

java

// Security patch excerpt: ConfigReposInternalControllerV4.java
 import com.thoughtworks.go.config.PartialConfigParseResult;
 import com.thoughtworks.go.config.PipelineConfigs;
 import com.thoughtworks.go.config.materials.PasswordDeserializer;
+import com.thoughtworks.go.config.materials.ScmMaterialConfig;
 import com.thoughtworks.go.config.remote.ConfigRepoConfig;
+import com.thoughtworks.go.domain.materials.Material;
 import com.thoughtworks.go.server.materials.MaterialUpdateService;
 import com.thoughtworks.go.server.service.*;
 import com.thoughtworks.go.spark.GlobalExceptionMapper;
// Source: https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918

The patch introduces stricter material and SCM configuration handling to bind the test to a validated context. See the GitHub Security Advisory GHSA-4557-94j8-5p66 for full technical detail.

Detection Methods for CVE-2026-55625

Indicators of Compromise

Requests to /go/api/admin/internal/material_test or /go/api/internal/config_repos/*/material_test originating from pipeline group administrators who do not own the referenced pipeline or group.
Anomalous secret-plugin resolution events tied to pipeline group admin sessions in GoCD 20.6.0 or later.
Unexpected outbound connection attempts from the GoCD server to source control endpoints not associated with the caller's authorized pipelines.

Detection Strategies

Enable GoCD access logging and correlate the pipeline/group parameters in material_test requests against the caller's authorized pipeline group membership.
Alert when a single admin account triggers material connection tests referencing multiple pipeline groups within a short window.
Review secret-plugin audit trails for lookups initiated during material_test API calls.

Monitoring Recommendations

Forward GoCD server access logs and secret plugin logs to a centralized log platform for correlation and long-term retention.
Baseline normal Test Connection usage per administrator and alert on deviations.
Monitor for changes to pipeline group admin role assignments and configuration repository ownership.

How to Mitigate CVE-2026-55625

Immediate Actions Required

Upgrade GoCD to version 26.1.0 or later, which contains the reworked material connection and admin authorization logic.
Audit current pipeline group administrator assignments and revoke any that are no longer necessary.
Rotate credentials and secrets that were reachable through affected materials, especially global reusable secrets in deployments running 20.6.0 or later.

Patch Information

The fix is available in GoCD Release 26.1.0. The corrective commit is published as GitHub commit f0dda0f. Refer to the GoCD Official Release Notes for upgrade guidance and the GitHub Security Advisory GHSA-4557-94j8-5p66 for the vendor disclosure.

Workarounds

Restrict network access to the GoCD server management interface so only trusted operator networks can reach the internal material_test endpoints.
Minimize the number of pipeline group administrator accounts until the upgrade to 26.1.0 is complete.
Scope secret-management plugin permissions narrowly and avoid granting broad reusable secrets where per-pipeline secrets can be used.

bash

# Verify installed GoCD server version and upgrade path
curl -s https://gocd.example.com/go/api/version -H 'Accept: application/vnd.go.cd+json'

# Restrict access to internal material_test endpoints at the reverse proxy
# Example nginx location block
location ~ ^/go/api/(admin/internal/material_test|internal/config_repos/.*/material_test)$ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://gocd_upstream;
}