CVE-2026-55870 in GoCD
Summary
by MITRE • 09/21/2026
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in GoCD prior to version 26.1.0 represents a significant information disclosure flaw rooted in the inconsistent application of credential masking within read-only APIs. As a continuous delivery server, GoCD allows administrators to configure source control materials using URLs that may contain embedded credentials in the userinfo portion, such as https://user:[email protected]/repo.git. While modern best practices and official recommendations advocate for the use of dedicated username and password fields or integration with external secret management plugins, legacy configurations often retain these embedded credentials due to backward compatibility requirements. The core technical flaw lies in the fact that not all read-only APIs consistently apply URL masking when retrieving material details. Consequently, an authenticated user who possesses access to a specific pipeline can invoke certain API endpoints to retrieve configuration data where the source control URL is returned with the username and password visible in plaintext rather than being redacted or masked as expected.
This vulnerability enables unauthorized credential harvesting by any regular authenticated user within the GoCD environment. The operational impact is severe because it allows attackers who have compromised a standard developer account, which typically has limited permissions, to escalate their value by extracting sensitive authentication tokens for source control repositories. These credentials can then be used to access private codebases, inject malicious code into branches, or pivot further into other systems that rely on the same repository credentials. It is important to note that this vulnerability does not affect configurations where dedicated password fields are utilized, as those values remain encrypted and are not exposed through these API endpoints. The flaw specifically targets the legacy method of storing credentials directly within the material URL structure, highlighting a gap in input validation and output encoding logic across different API handlers for various material types.
From a classification perspective, this issue aligns with CWE-200: Information Exposure, as it involves the unintended leakage of sensitive system information to unauthorized actors. Furthermore, under the MITRE ATT&CK framework, this vulnerability facilitates Initial Access via Valid Accounts and can be leveraged in subsequent stages such as Collection or Credential Access if the extracted credentials are used to access external resources outside the immediate GoCD environment. The attack vector is classified as Network-based with an Authentication requirement, meaning it cannot be exploited by unauthenticated users but poses a high risk within environments where internal network segmentation does not strictly isolate user-facing API endpoints from sensitive configuration data stores.
To mitigate this vulnerability, organizations running versions of GoCD prior to 26.1.0 must upgrade immediately to version 26.1.0 or later, which addresses the inconsistency in URL masking across all relevant read-only APIs. In addition to upgrading, administrators should audit their pipeline configurations and migrate away from embedding credentials directly within source control material URLs. Instead, they should adopt the recommended practice of using dedicated username and password fields for authentication data or integrate with external secret management solutions such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault. This migration not only resolves the immediate exposure risk but also aligns the deployment with industry-standard security practices that emphasize separation of configuration logic from sensitive credential storage, thereby reducing the attack surface associated with legacy API behaviors and ensuring that credentials are handled through encrypted channels rather than plaintext URL parameters.