CVE-2026-55870: GoCD Information Disclosure Vulnerability

CVE-2026-55870 Overview

CVE-2026-55870 is an information disclosure vulnerability [CWE-200] in GoCD, an open-source continuous delivery server. GoCD versions prior to 26.1.0 return unmasked credentials embedded in the userinfo portion of source control material URLs through several read-only APIs. Authenticated users with access to an affected pipeline can retrieve these credentials without additional privileges. The issue affects legacy configurations where credentials were stored in material URLs instead of dedicated password fields or secret-management plugins. Dedicated password fields remain encrypted and are not exposed by this flaw.

Critical Impact
Authenticated GoCD users can read cleartext source control credentials embedded in pipeline material URLs through read-only APIs, enabling downstream access to connected repositories.

Affected Products

GoCD continuous delivery server, all versions prior to 26.1.0
Pipelines using Git material configurations with credentials in URLs
Pipelines using Mercurial (Hg) material configurations with credentials in URLs

Discovery Timeline

2026-09-21 - CVE-2026-55870 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-55870

Vulnerability Analysis

GoCD supports source control material configurations for Git, Mercurial, Subversion, and other version control systems. Administrators can supply credentials through dedicated username and password fields, secret-management plugins, or by embedding them directly in the material URL using the userinfo component (for example, https://user:token@host/repo.git).

While GoCD encrypts credentials stored in dedicated password fields, credentials embedded in the URL were returned in cleartext by multiple read-only APIs. The material representer classes serialized the raw url property instead of the masked uriForDisplay variant. Any authenticated user with view access to a pipeline could query these APIs and recover the embedded credentials.

Root Cause

The root cause is inconsistent application of URL masking across material representers in the GoCD API layer. The GitMaterialRepresenter and HgMaterialRepresenter classes invoked getUrl() on the material configuration object, which returns the URL including any userinfo credentials. The masked equivalent, getUriForDisplay(), was already available but not used consistently across every mixed-use API and material type.

Attack Vector

Exploitation requires an authenticated GoCD account with access to an affected pipeline. The attacker issues a GET request to a read-only material or compare API endpoint that returns pipeline material configuration. The JSON response contains the raw url field with embedded credentials, which the attacker can then use to authenticate directly against the underlying source control system.

java

// Vulnerable code path (pre-patch) in GitMaterialRepresenter.toJSON
public static void toJSON(OutputWriter jsonWriter, GitMaterialConfig gitMaterialConfig) {
    ScmMaterialRepresenter.toJSON(jsonWriter, gitMaterialConfig);
    jsonWriter.add("url", gitMaterialConfig.getUrl());              // returns raw url with userinfo
    jsonWriter.addWithDefaultIfBlank("branch", gitMaterialConfig.getBranch(), "master");
    jsonWriter.add("submodule_folder", gitMaterialConfig.getSubmoduleFolder());
    jsonWriter.add("shallow_clone", gitMaterialConfig.isShallowClone());
}
// Source: https://github.com/gocd/gocd/commit/19c415d918bb50cb5a3ab7c28e01f4dd51ecb6a5

Detection Methods for CVE-2026-55870

Indicators of Compromise

Authenticated API requests to compare-v2 material endpoints (for example, /api/pipelines/*/compare/*) from accounts not associated with pipeline administration.
JSON responses from GoCD material APIs containing url values with user:password@ patterns.
Unexpected clones, pulls, or authentications against source control systems from GoCD user identities embedded in material URLs.

Detection Strategies

Audit the GoCD cruise-config.xml for material entries where the URL contains embedded credentials.
Review GoCD access logs for reads against material and compare APIs correlated with users lacking a legitimate need for pipeline configuration data.
Correlate source control provider audit logs against GoCD user activity to identify credentials sourced from material URLs.

Monitoring Recommendations

Enable and forward GoCD server access logs to a central log platform and alert on high-volume material API reads by any single authenticated user.
Monitor version control platforms (GitHub, GitLab, Bitbucket) for authentication events using tokens configured in GoCD material URLs.
Track rotations of any credential that was previously stored in a material URL and validate no legacy references remain.

How to Mitigate CVE-2026-55870

Immediate Actions Required

Upgrade GoCD to version 26.1.0 or later, which applies masking consistently across affected material representers.
Enumerate all pipeline material configurations for embedded userinfo credentials and rotate any credentials that were exposed.
Migrate credentials from material URLs to dedicated username and password fields or a supported secret-management plugin.
Review authenticated user accounts and remove pipeline access for users who no longer require it.

Patch Information

The fix is available in the GoCD 26.1.0 release and documented in the GoCD Security Advisory GHSA-5m25-5j77-c887. The patch in commit 19c415d replaces getUrl() with getUriForDisplay() in the affected representers so that userinfo is stripped before serialization. Release notes are published on the GoCD Release Page for 26.1.0.

Workarounds

Remove userinfo credentials from every material URL and reconfigure the material to use GoCD's dedicated username and password fields.
Store secrets in a GoCD secret-management plugin and reference them from material configurations rather than embedding them in URLs.
Restrict pipeline view permissions so only trusted operators can query affected APIs until the upgrade is applied.

bash

# Verify installed GoCD server version and plan the upgrade
curl -su <admin>:<token> https://gocd.example.com/go/api/version \
  -H 'Accept: application/vnd.go.cd+json'

# Grep the GoCD configuration for material URLs containing embedded credentials
grep -E 'url="https?://[^"]*:[^"]*@' /etc/go/cruise-config.xml