CVE-2026-52743
- Source
- https://cve.org/CVERecord?id=CVE-2026-52743
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52743.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-52743
- Aliases
-
- GHSA-2x6r-h7h3-wqc4
- Published
- 2026-09-21T14:24:57Z
- Modified
- 2026-09-27T08:04:14Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- GoCD before 26.1.0 is vulnerable to authorization bypass via job status API
- Details
-
GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-639", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52743.json" }- References
-
- https://github.com/gocd/gocd/releases/tag/26.1.0
- https://www.gocd.org/releases/#26-1-0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52743.json
- https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4
- https://nvd.nist.gov/vuln/detail/CVE-2026-52743
- https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a
Affected packages
Git / github.com/gocd/gocd
Affected versions
14.*
14.2.0
14.3.0
14.4.0
15.*
15.1.0
15.2.0
15.3.0
16.*
16.1.0
16.10.0
16.11.0
16.12.0
16.2.0
16.3.0
16.4.0
16.5.0
16.6.0
16.7.0
16.8.0
16.9.0
17.*
17.1.0
17.10.0
17.11.0
17.12.0
17.2.0
17.3.0
17.4.0
17.5.0
17.6.0
17.7.0
17.8.0
17.9.0
18.*
18.1.0
18.10.0
18.11.0
18.12.0
18.2.0
18.3.0
18.4.0
18.5.0
18.6.0
18.7.0
18.8.0
18.9.0
19.*
19.1.0
19.10.0
19.11.0
19.12.0
19.2.0
19.3.0
19.4.0
19.5.0
19.6.0
19.7.0
19.8.0
19.9.0
20.*
20.1.0
20.10.0
20.2.0
20.3.0
20.4.0
20.5.0
20.6.0
20.7.0
20.8.0
20.9.0
21.*
21.1.0
21.2.0
21.3.0
21.4.0
22.*
22.1.0
22.2.0
22.3.0
23.*
23.1.0
23.2.0
23.3.0
23.4.0
23.5.0
24.*
24.1.0
24.2.0
24.3.0
24.4.0
24.5.0
25.*
25.1.0
25.2.0
25.3.0
25.4.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52743.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "75660153044973478613127633583518786983",
"length": 448
},
"id": "CVE-2026-52743-0697d291",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "shouldThrowErrorIfUserPassesANonNumericValueForPipelineCounter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "104506524285901946597806578726503900425",
"length": 1453
},
"id": "CVE-2026-52743-0b213fa8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "shouldFindTheLatestJobWhenJobStatusIsRequested"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293644107583814706305313834881514248581",
"43526100860380261015420273856821442599",
"157233936825244187698220557484897351053"
],
"threshold": 0.9
},
"id": "CVE-2026-52743-1edf0217",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250222003766494194465964995240362262739",
"length": 800
},
"id": "CVE-2026-52743-27d5397f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java",
"function": "shouldReturnUsefulErrorIfMoveConsoleArtifactsFails"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "171197570947316436406598700097502798139",
"length": 726
},
"id": "CVE-2026-52743-39d096a3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247131989553630143841491749325634560045",
"length": 1186
},
"id": "CVE-2026-52743-4923c06b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "shouldConsistElasticAgentInformationForAJobRunningOnAnElasticAgent"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"167310787671319880704586013075543971030",
"5984915229391533275370882051648105548",
"192955474033145904550962434970112537315",
"197153495761242834493589971656174347277",
"247058020676445209083537904824881345487",
"294435738797345654336039173055070896963",
"186863402011355345236398209627051018219",
"339800595558709879462529120490747185794",
"36272329898421219346643227371742015995",
"277550216236813442506206246269672507507",
"222347074574986166885315187426754687443",
"337663504492927969421366829639037216717",
"187717463545279389956536780879977745032",
"224144587333556193681176675498419295249",
"314685360988424901062298718306458163578",
"276373599703956158392091268449136264601",
"286244814513765532991366762229436754826",
"218531108604475178979550581042931030134",
"248787981139499900691697934881984888043"
],
"threshold": 0.9
},
"id": "CVE-2026-52743-51d31206",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/controller/JobController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"242845329942103176499584980153619596324",
"116683583868749165169126293130927330184",
"67838280893251589035261210131329029362",
"284552944029488558896952310850727004293",
"173708144044513085897575608745857115120",
"201035904513015086995402628196313325138",
"229753011831172269602249461064397733882",
"274760572376657329689048399465393994258",
"65622859762100620129452717992294003497",
"320652248838344130545554785030903575495",
"17659553555467946569729163751518749233",
"221229843849948357870879583846214523256",
"229464673383067274307473594735632397524",
"199937891722140811432855728349727888215",
"133702739339203275507724702100210825538",
"69181117045703708183135147503372527627",
"184234816899762506303881255454526234507",
"130209804052072629591073678555534548774",
"141048119859656319449587993110937500759",
"77040871629664248842299323978804397152",
"42090180828102117169401845866619076680",
"135910653665450501695890749704736693900",
"328819026116183513958489071111084878846",
"170107849412013156268039696314270553455",
"43527630792983126455497955929778360730",
"234752533289162631019779166560239862924",
"93322276039586968507727789202353645846",
"56662010322199019355093608970021488984",
"237952007581580294653128228204824275381",
"322713227647298953021444398068977043229",
"261123531395576404181009783421803873188",
"142251836387673106526481570610149231907",
"41217755118389153185792344275253823137",
"295666339323935229245890316948746782592",
"107288685443013549706484794773387439990",
"84233180458220846582071895908507662788",
"244882888591390517688994008288756002549",
"200367837518534927457200127229882619981",
"21048064166213922346717920230875243233",
"92935704611129315756818295023849863691",
"288905159603915944412934674860830616904",
"130755582982256673316831617650532184073",
"185985017065800440665252875398408519772",
"136452593493458833071823677225039500423",
"273092501218566700526845232486504451626",
"241118548662299308519155763239620162068",
"257239728902052157654781138916233665743",
"151334934890307182141600635395660149959",
"241993827096401937805439027526005127100",
"101691558874405262702469198802506552899",
"120575363983245227475965705431521576859",
"98810330347968840170232220202138803004",
"3171677645967365716786298563583442921",
"112777742897576475814769043547061889891",
"123335456682559623719877092559823774393",
"218903170516324274719176065809781104816",
"198416948792195807909428667483169144342",
"51470544733248474397464647318737651193",
"135347043417972944932587490488246015354",
"14736185719526343806173217043330638733",
"112562118489643357921455346408035648851",
"127897323912249798735277094434409143606",
"207013918262240352786306298459477442012",
"215785220663572215101046574461566206038",
"62750240858940945948654838016475662786",
"287752179976603219818238218304180048060"
],
"threshold": 0.9
},
"id": "CVE-2026-52743-5c219178",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275008169348601052773008368964727260268",
"length": 702
},
"id": "CVE-2026-52743-b936dc80",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/controller/JobController.java",
"function": "handleRequest"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "332311634346606361965270302052478671634",
"length": 65
},
"id": "CVE-2026-52743-d14fd14d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "tearDown"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203518208609609289392915257754008921163",
"length": 570
},
"id": "CVE-2026-52743-d1fe1e32",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "shouldNotHaveElasticAgentInformationIfJobMetadataDoesNotHaveClusterInformation"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "68494852494806831146805615650270627109",
"length": 437
},
"id": "CVE-2026-52743-e4bc66ae",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/controller/JobControllerTest.java",
"function": "shouldThrowErrorIfUserPassesANonNumericValueForStageCounter"
}
}
]
vanir_signatures_modified
"2026-09-27T08:04:14Z"