Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-52740

GoCD is vulnerable to pipeline template view API authorization bypass

CVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-52740

Published

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-52740

Published

gocd

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "gocd",
                    "product": "gocd",
                    "versions": [
                        {
                            "version": ">= 18.7.0, < 26.1.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON