CVE-2026-52743 in GoCD
Summary
by MITRE • 09/21/2026
GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in GoCD prior to version 26.1.0 represents a critical failure in access control mechanisms within the continuous delivery server's internal application programming interface. Specifically, the /jobStatus.json endpoint, which is designed to provide status information for specific build jobs, lacks proper authorization checks regarding resource ownership and visibility permissions. In secure software architecture, any API endpoint that returns sensitive operational data must verify not only that the user is authenticated but also that they possess explicit or implicit permission to access the specific resources being requested. The flaw lies in the server's logic, which accepts a job identifier provided by the client without cross-referencing it against the pipeline and stage identifiers included in the same request to ensure consistency and authorized scope. This architectural oversight allows an attacker who has valid credentials for any user account within the GoCD instance to bypass intended access controls through simple enumeration techniques.
From a technical perspective, this vulnerability is classified as Insecure Direct Object Reference (IDOR), corresponding to CWE-639 in the Common Weakness Enumeration standard. The core issue stems from the server trusting client-supplied input for resource identification without validating that the requested job ID actually belongs to the pipeline and stage specified by the user. Because GoCD uses sequential or predictable identifiers for jobs, an authenticated attacker can iterate through a range of potential job IDs. By submitting requests with varying job IDs while keeping the pipeline and stage names constant, or vice versa, the attacker can probe the system's response patterns. If the server returns data instead of an error indicating unauthorized access or non-existent resources, it confirms that the requested job exists and is accessible to the requester, regardless of whether the user has permission to view the associated pipeline in the UI. This behavior effectively decouples resource identification from authorization checks, a fundamental security anti-pattern.
The operational impact of this vulnerability extends beyond simple information disclosure; it facilitates broader reconnaissance activities against the target organization's software delivery infrastructure. An attacker can retrieve detailed metadata about jobs they are not authorized to view, including job names, current state, progress timestamps, and crucially, the IP addresses and UUIDs of the agents executing these builds. Exposure of agent IP addresses allows an attacker to map the internal network topology associated with CI/CD operations, identifying potential targets for lateral movement or further exploitation. The disclosure of pipeline and stage associations reveals the structure of the organization's deployment workflows, which can be used to identify critical services or dependencies. Although the vulnerability does not expose console output, build artifacts, environment variables, or configuration files, limiting direct code execution risks, the intelligence gained significantly aids in planning subsequent attacks against more vulnerable components within the infrastructure.
This behavior aligns with several tactics and techniques defined in the MITRE ATT&CK framework for enterprise environments. It falls under the Initial Access tactic via Valid Accounts, as it requires authentication but exploits a flaw to gain unauthorized data access. More specifically, it maps to Discovery techniques such as Account Enumeration (T1087) if used to determine valid job IDs, and more accurately to Internal Network Discovery (T1016) due to the exposure of agent IP addresses. The ability to view pipeline structures also contributes to Application Data Discovery (T1530), allowing attackers to understand how applications are built and deployed. These capabilities enable an adversary to build a comprehensive picture of the CI/CD environment, which is often considered a high-value target because compromise can lead to supply chain attacks or widespread system infiltration through trusted deployment pipelines.
Mitigation for this vulnerability requires immediate upgrading to GoCD version 26.1.0 or later, where the developers have implemented proper validation logic to ensure that job IDs are correctly associated with authorized pipeline and stage contexts before returning data. For organizations unable to upgrade immediately due to operational constraints, compensating controls should be applied at the network perimeter level. Implementing a Web Application Firewall (WAF) rule set can help detect and block abnormal patterns of requests indicative of IDOR exploitation, such as rapid sequential access to different job IDs from a single source IP address. Additionally, ensuring that internal APIs like /jobStatus.json are not exposed directly to untrusted networks or public-facing interfaces reduces the attack surface. Regular security audits focusing on authorization logic in API endpoints and adherence to principle of least privilege for service accounts can further harden the environment against similar access control flaws.