CVE-2026-58370

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58370
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58370.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58370
Published
2026-06-30T15:57:09.624Z
Modified
2026-07-16T03:31:11.781734471Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name
Details

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.

Database specific 
{
    "cwe_ids": [
        "CWE-290"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58370.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/woodpecker-ci/woodpecker

Affected ranges

Type
GIT
Repo
https://github.com/woodpecker-ci/woodpecker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0812d5e790472290eae75a3f329c85af41d203b0
Fixed
98faae778c953678944996c89ed99307d2f16a3d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.15.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.13.0-rc.1
v0.13.0-rc.2
v0.13.0-rc.3
v0.14.0
v0.14.0-rc.1
v0.14.0-rc.2
v0.15.0
v0.15.0-rc1
v0.15.0-rc2
v0.8.100
v0.8.101
v0.8.102
v0.8.103
v0.8.104
v0.8.105
v0.8.106
v0.8.91
v0.8.92
v0.8.93
v0.8.94
v0.8.95
v0.8.96
v0.8.97
v0.8.98
v0.8.99
v0.9.0
v0.9.1
v0.9.2
v2.*
v2.0.0
v2.0.0-rc.0
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v3.*
v3.0.0
v3.0.0-rc.0
v3.0.1
v3.1.0
v3.10.0
v3.11.0
v3.11.0-rc.0
v3.12.0
v3.13.0
v3.14.0
v3.14.0-rc.0
v3.14.0-rc.1
v3.14.0-rc.2
v3.2.0
v3.3.0
v3.4.0
v3.5.0
v3.5.1
v3.5.2
v3.6.0
v3.7.0
v3.8.0
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58370.json"