Gocd vulnerabilities
26 CVEs and advisories name Gocd as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-55632GoCD is vulnerable to authorization bypass via pipeline structure API
- CVE-2026-52744GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
- CVE-2026-52742GoCD is vulnerable to historical server configuration API authorization bypass
- CVE-2026-55870GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
- CVE-2026-55625GoCD is vulnerable to authorization bypass via material connection test APIs
- CVE-2026-52740GoCD is vulnerable to pipeline template view API authorization bypass
- CVE-2026-55060GoCD is vulnerable to authorization bypass via support process list API
- CVE-2026-52741GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
- CVE-2026-68919GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
- CVE-2026-52743GoCD before 26.1.0 is vulnerable to authorization bypass via job status API
- CVE-2024-56324GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins
- CVE-2024-56322GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality
- CVE-2024-56321GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access
- CVE-2024-56320GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user
- CVE-2024-28866GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up
- CVE-2023-28629Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd
- CVE-2023-28630Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd
- CVE-2022-39311Compromised agents may be able to execute remote code on GoCD Server
- CVE-2022-39310Malicious agent may be able to impersonate another agent in GoCD
- CVE-2022-39309GoCD server secret encryption/decryption key leaked to agents during material serialization
- CVE-2022-39308GoCD API authentication of user access tokens subject to timing attack during comparison
- CVE-2022-36088GoCD Windows installations outside default location inadequately restrict installation file permissions
- CVE-2022-29184Command Injection/Argument Injection in GoCD
- CVE-2022-29183Reflected XSS in GoCD
- CVE-2022-29182DOM-based XSS in GoCD
- CVE-2022-24832Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames