CVE-2026-50141

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones.

CVSS

No CVSS.

References

Link	Resource
https://github.com/woodpecker-ci/woodpecker-security/issues/21
https://github.com/woodpecker-ci/woodpecker/issues/6541
https://github.com/woodpecker-ci/woodpecker/pull/6567
https://github.com/woodpecker-ci/woodpecker/pull/6569
https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Woodpecker es un motor de CI/CD. A partir de la versión 3.0.0 y antes de la versión 3.14.1, una vulnerabilidad en la capa gRPC de Woodpecker CI permitía a cualquier agente autenticado suplantar a cualquier otro agente en el mismo servidor inyectando un valor ’agent_id’ falsificado en los metadatos gRPC salientes. El servidor verificaba correctamente el token JWT pero luego descartaba la identidad del agente verificada en favor del valor proporcionado por el cliente. La versión 3.14.1 corrige el problema. Como solución alternativa, deshabilite los agentes de la organización (’WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true’) y elimine los existentes.

Information

Published : 2026-06-18 14:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-50141

Mitre link : CVE-2026-50141

CVE.ORG link : CVE-2026-50141

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-50141", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50141", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T15:21:39.524543Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "woodpecker-ci", "product": "woodpecker", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.14.1"}]}]}], "published": "2026-06-18T14:17:29.400", "references": [{"url": "https://github.com/woodpecker-ci/woodpecker-security/issues/21", "source": "security-advisories@github.com"}, {"url": "https://github.com/woodpecker-ci/woodpecker/issues/6541", "source": "security-advisories@github.com"}, {"url": "https://github.com/woodpecker-ci/woodpecker/pull/6567", "source": "security-advisories@github.com"}, {"url": "https://github.com/woodpecker-ci/woodpecker/pull/6569", "source": "security-advisories@github.com"}, {"url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones."}, {"lang": "es", "value": "Woodpecker es un motor de CI/CD. A partir de la versi\u00f3n 3.0.0 y antes de la versi\u00f3n 3.14.1, una vulnerabilidad en la capa gRPC de Woodpecker CI permit\u00eda a cualquier agente autenticado suplantar a cualquier otro agente en el mismo servidor inyectando un valor \u2019agent_id\u2019 falsificado en los metadatos gRPC salientes. El servidor verificaba correctamente el token JWT pero luego descartaba la identidad del agente verificada en favor del valor proporcionado por el cliente. La versi\u00f3n 3.14.1 corrige el problema. Como soluci\u00f3n alternativa, deshabilite los agentes de la organizaci\u00f3n (\u2019WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true\u2019) y elimine los existentes."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}