CVE-2026-55632: GoCD Information Disclosure Vulnerability

CVE-2026-55632 Overview

GoCD is a continuous delivery server used to model and orchestrate build and deployment pipelines. CVE-2026-55632 is an authorization flaw in the internal pipeline structure API that supports autocompletion when editing pipeline, template, environment, and user-preference configurations. The endpoint returns its users-and-roles mode to any authenticated user, without enforcing an administrator role check. A lower-privileged user can enumerate configured usernames and role names. The issue affects versions from 20.2.0 up to but not including 26.1.0 and is fixed in 26.1.0. The endpoint does not disclose role assignments per user and cannot modify data, limiting impact to information disclosure [CWE-863].

Critical Impact
Authenticated low-privileged users can enumerate all configured GoCD usernames and role names, providing reconnaissance data to target further attacks against those accounts.

Affected Products

GoCD versions 20.2.0 through 26.0.x
GoCD internal pipeline structure API (api-internal-pipeline-structure-v1)
GoCD internal pipeline groups API (api-internal-pipeline-groups-v1)

Discovery Timeline

2026-09-23 - CVE CVE-2026-55632 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-55632

Vulnerability Analysis

The vulnerability resides in GoCD's internal pipeline structure API. This endpoint powers autocompletion in the web UI when administrators edit pipelines, templates, environments, and user preferences. The API supports several response modes, including a users-and-roles mode that returns configured usernames and role names.

The endpoint enforces authentication but does not restrict the users-and-roles mode to administrators. Any authenticated GoCD user can invoke the API and receive the full list of configured principals and roles. The response does not include role-to-user assignments, and the endpoint provides read-only access.

Root Cause

The root cause is missing authorization enforcement on a sub-mode of an internal API [CWE-863]. The controller registered pipeline group authorization suppliers using a permissive viewableOrOperatableGroupsForIncludingConfigRepos lookup for the operate mode, and the users-and-roles path did not gate access on administrator role membership. The fix narrows authorization scoping and simplifies the pipeline structure response.

Attack Vector

Exploitation requires a valid low-privileged GoCD account and network reach to the server. The attacker authenticates and issues a request to the internal pipeline structure endpoint with the users-and-roles mode. The server returns the configured usernames and role names, which the attacker uses to build a target list for password spraying, phishing, or social engineering.

java

// Patch: api/api-internal-pipeline-groups-v1/.../InternalPipelineGroupsControllerV1.java
 this.apiAuthorizationHelper = apiAuthorizationHelper;
 this.pipelineGroupAuthorizationRegistry = Map.of(
         "view", () -> pipelineConfigService.viewableGroupsForUserIncludingConfigRepos(currentUsername()),
-        "operate", () -> pipelineConfigService.viewableOrOperatableGroupsForIncludingConfigRepos(currentUsername()),
+        "operate", () -> pipelineConfigService.operableGroupsForIncludingConfigRepos(currentUsername()),
         "administer", () -> pipelineConfigService.adminGroupsForIncludingConfigRepos(currentUsername())
 );
 this.environmentConfigService = environmentConfigService;

Source: GitHub commit c93d9e7. The patch tightens the operate supplier to return only groups the user can operate, removing the broader viewableOrOperatable fallback that widened exposure.

Detection Methods for CVE-2026-55632

Indicators of Compromise

Requests from non-administrator sessions to the internal pipeline structure API with a users-and-roles mode parameter.
Unusual volumes of GET requests to /go/api/admin/internal/pipeline_structure originating from low-privileged accounts.
Follow-on authentication activity (password spraying, credential stuffing) against usernames enumerated from GoCD.

Detection Strategies

Review GoCD access logs for requests to internal pipeline structure and pipeline groups endpoints made by users lacking the administrator role.
Correlate GoCD authentication logs with subsequent failed logins across identity providers to detect enumeration-driven credential attacks.
Alert on repeated internal API calls that carry the users-and-roles parameter from a single session.

Monitoring Recommendations

Forward GoCD server access and audit logs to a centralized log platform for querying and retention.
Baseline normal usage of internal autocompletion APIs by administrators, then alert on deviations by role.
Monitor identity providers integrated with GoCD for spikes in failed authentications shortly after suspicious API activity.

How to Mitigate CVE-2026-55632

Immediate Actions Required

Upgrade GoCD to version 26.1.0 or later, which contains the authorization fix.
Audit GoCD user accounts and remove inactive or unnecessary low-privileged accounts that could be used to reach the vulnerable endpoint.
Rotate credentials for any account whose username may already be known to untrusted parties following disclosure.

Patch Information

The fix is included in GoCD 26.1.0. See the GitHub Security Advisory GHSA-57pf-j652-c3c9, the GitHub Release 26.1.0 notes, and the GoCD 26.1.0 release information. The upstream commit is c93d9e7.

Workarounds

Restrict network access to the GoCD server so that only trusted operators can authenticate and reach internal APIs.
Enforce strong, unique passwords and multi-factor authentication on the identity provider fronting GoCD to reduce impact of username enumeration.
Review role assignments and reduce the number of authenticated accounts while an upgrade is planned.

bash

# Verify installed GoCD server version and upgrade path
curl -s -u admin:PASSWORD https://gocd.example.com/go/api/version \
  -H 'Accept: application/vnd.go.cd+json'

# On Debian/Ubuntu, upgrade to the patched release
sudo apt-get update && sudo apt-get install --only-upgrade go-server=26.1.0-*
sudo systemctl restart go-server