CVE-2026-55060
- Source
- https://cve.org/CVERecord?id=CVE-2026-55060
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55060.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55060
- Aliases
-
- GHSA-vqjf-7pf8-hgwr
- Published
- 2026-09-21T14:58:39Z
- Modified
- 2026-09-26T08:12:54Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- GoCD is vulnerable to authorization bypass via support process list API
- Details
-
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55060.json" }- References
-
- https://github.com/gocd/gocd/releases/tag/26.1.0
- https://www.gocd.org/releases/#26-1-0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55060.json
- https://github.com/gocd/gocd/security/advisories/GHSA-vqjf-7pf8-hgwr
- https://nvd.nist.gov/vuln/detail/CVE-2026-55060
- https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8
Affected packages
Git / github.com/gocd/gocd
Affected versions
14.*
14.2.0
14.3.0
14.4.0
15.*
15.1.0
15.2.0
15.3.0
16.*
16.1.0
16.10.0
16.11.0
16.12.0
16.2.0
16.3.0
16.4.0
16.5.0
16.6.0
16.7.0
16.8.0
16.9.0
17.*
17.1.0
17.10.0
17.11.0
17.12.0
17.2.0
17.3.0
17.4.0
17.5.0
17.6.0
17.7.0
17.8.0
17.9.0
18.*
18.1.0
18.10.0
18.11.0
18.12.0
18.2.0
18.3.0
18.4.0
18.5.0
18.6.0
18.7.0
18.8.0
18.9.0
19.*
19.1.0
19.10.0
19.11.0
19.12.0
19.2.0
19.3.0
19.4.0
19.5.0
19.6.0
19.7.0
19.8.0
19.9.0
20.*
20.1.0
20.10.0
20.2.0
20.3.0
20.4.0
20.5.0
20.6.0
20.7.0
20.8.0
20.9.0
21.*
21.1.0
21.2.0
21.3.0
21.4.0
22.*
22.1.0
22.2.0
22.3.0
23.*
23.1.0
23.2.0
23.3.0
23.4.0
23.5.0
24.*
24.1.0
24.2.0
24.3.0
24.4.0
24.5.0
25.*
25.1.0
25.2.0
25.3.0
25.4.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55060.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "224562660110374750433141777001714967764",
"length": 249
},
"id": "CVE-2026-55060-011d085e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "api/api-support/src/main/java/com/thoughtworks/go/api/support/ApiSupportController.java",
"function": "processList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69607793450102706566783712859210305712",
"length": 353
},
"id": "CVE-2026-55060-020d7687",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "api/api-support/src/main/java/com/thoughtworks/go/api/support/ApiSupportController.java",
"function": "show"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293644107583814706305313834881514248581",
"43526100860380261015420273856821442599",
"157233936825244187698220557484897351053"
],
"threshold": 0.9
},
"id": "CVE-2026-55060-1edf0217",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"72454519561525162206344612601537261526",
"112163355829045966058906115789861605798",
"228558983498214973073928927048807865773",
"225316873518682379679187067193450576073",
"137295925777898552832010619392298871847",
"110780049436696221195288285053618731487",
"286522175257383869899957979868791886576",
"290703775618641146489282914148696253901",
"230882686691030028978018252574527543197",
"29970211111580159975474172800514925703",
"17006296942939701447460609015631276663",
"332839786985354125121806212054043778364",
"22833023335418475698410468218727045206",
"166389436037417125812196346221514397889",
"274649125611559433093123620030430843975",
"222941829922346331481335319512894426528",
"156229229281963104522122451134591137102",
"169271697091712640243782652982481393957",
"132471268093477933116914547349531810047",
"160440484137485933106244594141646542398",
"25118388539282798915767379356348303409",
"16319478910297010444057431749915445752",
"137950251540209508330043380329731882315",
"99926021805764710071092848476874132734",
"328336883190896657420872594412081594322",
"155351420830153030752442923541025638171",
"11577518471330145890598274149379807506",
"204169105885546736626333991457115341234",
"99308927636689875149769085022203508355",
"264391592075093858050901883257820732396",
"147129527593616714796308289639543233088",
"281530372229802804936280000757298630659",
"182535112008412012664912084686613867808",
"334867916767128929766148048700209416919",
"160322057037748860093535834743009888349",
"51602205092928297825533803588539417500",
"11346973390157532830612871591770263253",
"86436972176955317255252325236605319580",
"321766291489586934158386405112266043823",
"125958495393499679147768357062598229978",
"68472578057342098503580135451010975881",
"6865144473247393001833302216822201177"
],
"threshold": 0.9
},
"id": "CVE-2026-55060-1ef877a9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "api/api-support/src/main/java/com/thoughtworks/go/api/support/ApiSupportController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250222003766494194465964995240362262739",
"length": 800
},
"id": "CVE-2026-55060-27d5397f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2",
"target": {
"file": "server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java",
"function": "shouldReturnUsefulErrorIfMoveConsoleArtifactsFails"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "216190859915552726671707505792069809036",
"length": 51
},
"id": "CVE-2026-55060-4494adbd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "api/api-support/src/main/java/com/thoughtworks/go/api/support/ApiSupportController.java",
"function": "ApiSupportController"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "296487073097668487301539310748987722981",
"length": 195
},
"id": "CVE-2026-55060-8866d2f4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/service/support/ServerStatusService.java",
"function": "ServerStatusService"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"183759033047420426453886364454385460141",
"43141096634655036960536406932702216122",
"225017832222672191340916956500899728322",
"12131260884037094356570795764810795232",
"269516194596974393129730672452786759427",
"317468683754347869021481652479925519921",
"28985594525637295083556732041793896440",
"214885674906977637671631913533311276227",
"101525350025797644392541049532139801784",
"213007783002267544245252206829620152534",
"242790978765004281059170864423080337891",
"138319090070597398783990406404939697379",
"314832615681684862735626992607648821328",
"169525070568747965351084929306777145764",
"175420895177217136203480475712912317237",
"319605586100476724425214547979163749764",
"80972899687180777579815703432677151585",
"119808090109854048196096661165317200719",
"331771347307199966888586452472766317930",
"6718470503163139852984326303652552654",
"30492578243176384770182938206209424162",
"318233034169403507864062801396556809127",
"282210099247978651352568412205522856695",
"332124262796958973687798184019471401764",
"266102042761338825406770126040451070094"
],
"threshold": 0.9
},
"id": "CVE-2026-55060-8fd1a5a8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/service/support/ServerStatusService.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"274149661047992222179547018310640400849",
"308459470722739176999693357822939274917",
"246785159901037592072091339456285612312",
"286082024924805234526991010316329456244"
],
"threshold": 0.9
},
"id": "CVE-2026-55060-ad27f726",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/newsecurity/filterchains/AuthorizeFilterChain.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "155790583062366533120714854954790121485",
"length": 3809
},
"id": "CVE-2026-55060-b9656e66",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/newsecurity/filterchains/AuthorizeFilterChain.java",
"function": "AuthorizeFilterChain"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "24243337975143785119518637928304359745",
"length": 525
},
"id": "CVE-2026-55060-c5b069a3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/service/support/ServerStatusService.java",
"function": "serverInfoAsJsonCompatibleMap"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"173891536335400851474911879379604813373",
"68495545159856881147586446121866489868",
"264123029060605188330863681660331594632",
"17834329115248620190463660021468664324"
],
"threshold": 0.9
},
"id": "CVE-2026-55060-c80d47ec",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/test-integration/java/com/thoughtworks/go/server/service/ConfigSaveDeadlockDetectionIntegrationTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291297111874270629223253227246375756795",
"length": 222
},
"id": "CVE-2026-55060-dcea1af2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "server/src/main/java/com/thoughtworks/go/server/service/support/ServerStatusService.java",
"function": "asJsonCompatibleMap"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "158332688688545310361481883726728703567",
"length": 177
},
"id": "CVE-2026-55060-e225bc5a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gocd/gocd/commit/fbf832f9358d96466bb87fad11a1de0ba935fea8",
"target": {
"file": "api/api-support/src/main/java/com/thoughtworks/go/api/support/ApiSupportController.java",
"function": "setupRoutes"
}
}
]
vanir_signatures_modified
"2026-09-26T08:12:54Z"