CVE-2026-52740

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52740
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52740.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52740
Aliases
  • GHSA-9jfm-4f6v-79wh
Published
2026-09-21T14:59:15Z
Modified
2026-09-23T08:15:48Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
GoCD is vulnerable to pipeline template view API authorization bypass
Details

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52740.json"
}
References

Affected packages

Git / github.com/gocd/gocd

Affected ranges

Type
GIT
Repo
https://github.com/gocd/gocd
Events
Introduced
75d1247f58ab8bcde3c5b43392a87347979f82c5
Fixed
614d694c6d9d8714517db8f9f1581cc1c140506a
Fixed
55b7b460510bb739c1ae6d226ff7fb650596dca2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "18.7.0"
        },
        {
            "fixed":  "26.1.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

18.*
18.10.0
18.11.0
18.12.0
18.7.0
18.8.0
18.9.0
19.*
19.1.0
19.10.0
19.11.0
19.12.0
19.2.0
19.3.0
19.4.0
19.5.0
19.6.0
19.7.0
19.8.0
19.9.0
20.*
20.1.0
20.10.0
20.2.0
20.3.0
20.4.0
20.5.0
20.6.0
20.7.0
20.8.0
20.9.0
21.*
21.1.0
21.2.0
21.3.0
21.4.0
22.*
22.1.0
22.2.0
22.3.0
23.*
23.1.0
23.2.0
23.3.0
23.4.0
23.5.0
24.*
24.1.0
24.2.0
24.3.0
24.4.0
24.5.0
25.*
25.1.0
25.2.0
25.3.0
25.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52740.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "164393759582334346651275302721640510991",
            "length":  99
        },
        "id":  "CVE-2026-52740-08133db4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java",
            "function":  "setMultipartUpload"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "23106156625874585062169197514776666039",
                "272886987405104048865003318002543196235",
                "278672799419391427670217071912681694522",
                "99793023533661016266717491058340328786",
                "299504076254951852191832368574439519842",
                "51954220052140558074335416893056033297",
                "152053190811917623805703532516429024682",
                "49727394237545543631977974267780898648",
                "113088237201545440404319630626547687777",
                "88509678824923195038834235748981988476"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-0e8873d8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "spark/spark-base/src/main/java/com/thoughtworks/go/spark/SparkController.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "166296450795468483478980872355244317409",
            "length":  174
        },
        "id":  "CVE-2026-52740-1720df16",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "spark/spark-base/src/main/java/com/thoughtworks/go/spark/spring/RouteEntry.java",
            "function":  "isAPI"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "293644107583814706305313834881514248581",
                "43526100860380261015420273856821442599",
                "157233936825244187698220557484897351053"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-1edf0217",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2",
        "target":  {
            "file":  "server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "250222003766494194465964995240362262739",
            "length":  800
        },
        "id":  "CVE-2026-52740-27d5397f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2",
        "target":  {
            "file":  "server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java",
            "function":  "shouldReturnUsefulErrorIfMoveConsoleArtifactsFails"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "38771258555525496280364132767010392697",
                "77064376400510894845692497527010175481",
                "57435296091957921389259827822123870300",
                "104273936234290854458728416675886066698"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-2c934fd3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-plugin-images/src/main/java/com/thoughtworks/go/api/pluginimages/PluginImagesController.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "48641310032374652173733552332364689344",
                "109478149295124471267336575711884617889",
                "58104110657883947900887752589609710409",
                "78391500584254355365909221986420623780",
                "47081780562710979575318400205872720133",
                "289283500895312908821305396908403317158",
                "38965087205558800720031350924356422267",
                "312949377132371368955661022852036892057",
                "27596722131798805523886064897868223983",
                "33389276543329654220095817896981579096",
                "295352357592563048332165488126495294885"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-36d40f6d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-template-config-v7/src/main/java/com/thoughtworks/go/apiv7/admin/templateconfig/TemplateConfigControllerV7.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "48641310032374652173733552332364689344",
                "109478149295124471267336575711884617889",
                "75541841599013500455465963559501004963",
                "292927150501516638869613001939805434063",
                "179077737272182502366318469523764959079",
                "219588236863933931129927872782153076850",
                "55775713105650840713249485280478088847",
                "45937022724140041389642009313346399151",
                "192583521375453913961168176171253951150"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-480d0144",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-pipeline-groups-v1/src/main/java/com/thoughtworks/go/apiv1/admin/pipelinegroups/PipelineGroupsControllerV1.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317808285017307722539573638342082079405",
            "length":  207
        },
        "id":  "CVE-2026-52740-5e29279f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java",
            "function":  "onlyOn"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "290730851216290548291809033880285075232",
                "220903542472111654462688541918183620260",
                "329513306548584424067731181272302248806",
                "33447400154710961199967559674498713580"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-70f25f3e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "server/src/main/java/com/thoughtworks/go/server/newsecurity/filters/RememberLastRequestUrlFilter.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "205686126707678844256996826269785804015",
            "length":  806
        },
        "id":  "CVE-2026-52740-70f61c45",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-plugin-images/src/main/java/com/thoughtworks/go/api/pluginimages/PluginImagesController.java",
            "function":  "show"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "187410573084951694364523401296161738907",
            "length":  553
        },
        "id":  "CVE-2026-52740-766a851d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java",
            "function":  "verifyContentType"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "147532876559712335212581987791387391488",
            "length":  1021
        },
        "id":  "CVE-2026-52740-8a954a62",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-pipeline-groups-v1/src/main/java/com/thoughtworks/go/apiv1/admin/pipelinegroups/PipelineGroupsControllerV1.java",
            "function":  "setupRoutes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "175311621342228281262844091459779911323",
                "128221825690398409242932558779378720702",
                "263991643074757263337155141268055293898",
                "339663703186429108183975814530158485664",
                "45018259694652864027184148480287194258",
                "157531080260574072479030247308956174913",
                "288787292049242112436759787921918791306"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-9bd5e168",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "spark/spark-base/src/main/java/com/thoughtworks/go/spark/spring/RouteEntry.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "280345982475444026474299332026001469132",
                "144333624021763528570121583427998702002",
                "287039846370791488630247101901954287960",
                "12896525014386530499092111968363671446",
                "115994799278443540418434404869276552096",
                "313508066203896308412218993262150579267",
                "217073984665250453112364663762767494059",
                "18728782507587789094307628443950508555",
                "152643591674016647159728371700617471263",
                "119891514431608965773776442327040416122",
                "289976031417861944782232949122644661555",
                "149845531197953701554751481257646526721",
                "163731824104703056970410624438153190426",
                "73637172545033124391065123378294109733",
                "107334168511388226746461501915808733267",
                "305089321203520134620276053895420121071",
                "25882109528339361657225627981413338059",
                "161761904852338628165654055439082555948",
                "92405303431767836468750101817148859411",
                "74002471220012461798416178516968151556",
                "10492933163417035144169904433970757214",
                "151355920742328996898022672943071881188",
                "149179917387333167579723318027631973654",
                "136914798260052061760527264308555750438",
                "95595399738156940055375159127433431301",
                "261593513411573144501337096179820877389",
                "83067846577267379275426746723941928913"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-a53aa490",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "12503590976553436403439966715832949443",
            "length":  1010
        },
        "id":  "CVE-2026-52740-adc2caf6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-notification-filter-v2/src/main/java/com/thoughtworks/go/apiv2/notificationfilter/NotificationFilterControllerV2.java",
            "function":  "setupRoutes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "319346411546586734007045089626246746620",
                "109478149295124471267336575711884617889",
                "58104110657883947900887752589609710409",
                "78391500584254355365909221986420623780",
                "283033164189821165560514441721881624507",
                "299195488403419679261745496219809601114",
                "37026519620005925749984016347909500886",
                "165050798654648845037530130398083668650",
                "191722709695056456537753366093049998180",
                "130857355554121021035477702816020087620",
                "23898326370124412539858631761597155453",
                "167758373124721428643788055193180871568"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-52740-e233053c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-notification-filter-v2/src/main/java/com/thoughtworks/go/apiv2/notificationfilter/NotificationFilterControllerV2.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "330904792761665314846494379543338778927",
            "length":  1429
        },
        "id":  "CVE-2026-52740-eaf0efc3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a",
        "target":  {
            "file":  "api/api-template-config-v7/src/main/java/com/thoughtworks/go/apiv7/admin/templateconfig/TemplateConfigControllerV7.java",
            "function":  "setupRoutes"
        }
    }
]
vanir_signatures_modified 
"2026-09-23T08:15:48Z"