- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 4 · 1 critical, 3 high
- Registry
- pkg.go.dev
Advisories 4
- CVE-2026-61549Critical 9.0
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Affected: all versions.
- CVE-2026-50141High 7.1
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
Affected: all versions.
- CVE-2024-41122High 7.5
Custom environment variables allow to alter execution flow of plugins in Woodpecker
Affected: all versions; fixed in 2.7.0.
- CVE-2024-41121High 8.8
Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
Affected: all versions; fixed in 2.7.0.