CVE-2026-52740

Executive Summary

CVE-2026-52740 is an improper authorization vulnerability in GoCD's Get Template Config API, affecting versions 18.7.0 through 26.1.0. The API compares HTTP method names case‑sensitively when selecting authorization filters, allowing a lower‑privileged authenticated user to bypass view permission checks by sending requests with nonstandard HTTP method capitalization (e.g., get instead of GET). Successful exploitation enables unauthorized retrieval of pipeline template configuration data, which may expose sensitive pipeline logic, but does not permit modification of data or decryption of secure variables.

Technical Analysis

GoCD is a continuous delivery server used to model and automate build‑test‑release pipelines. The Get Template Config API is designed to return the configuration of a named pipeline template. Access to this API is governed by authorization filters that map HTTP methods (such as GET) to required permissions. According to the NVD description, the vulnerability arises because the method name comparison is case‑sensitive: "the Get Template Config API compares HTTP method names case‑sensitively when selecting authorization filters."

In practice, HTTP methods are expected to be uppercase (e.g., GET, POST). When a request uses a nonstandard capitalization such as get or Get, the authorization filter lookup fails to match the intended filter that enforces the "view" permission. As a result, the request is processed without the necessary view permission check, and the API returns the pipeline template configuration by name to any authenticated user, regardless of their actual permissions.

The vulnerability class is CWE‑863: Incorrect Authorization. It is a logic flaw in the authorization layer, not a memory‑safety or injection issue. The attack surface is the network‑exposed GoCD API endpoint, which is typically accessible to authenticated users within an organization. The flaw does not affect API operations that modify data, nor does it compromise the encryption of secure variables. Environments where a reverse proxy or web server normalizes or rejects non‑uppercase HTTP methods are not affected, because the malformed method would never reach the GoCD server.

No public proof‑of‑concept or exploit code is available, and no Nuclei template exists. The technical details provided are sufficient to understand the mechanism: a user with valid credentials but lacking template view permission can craft an HTTP request using a lowercased method to bypass the filter.

Exploitation Scenarios

1) Reconnaissance / target identification: An attacker with low‑privileged authenticated access (e.g., a regular GoCD user) identifies a GoCD instance version 18.7.0 or later, up to but not including 26.1.0. The attacker can determine the version via error pages, API responses, or login banners. The target is any GoCD server reachable over the network where the attacker holds valid credentials.

2) Triggering the flaw: The attacker sends an HTTP request to the Get Template Config API with a nonstandard, lowercase method such as get instead of GET. This can be done using tools like curl or a custom script that allows arbitrary HTTP method capitalization. The request includes the name of a pipeline template that the attacker does not have permission to view.

3) Payload / execution method: The payload is simply the malformed HTTP method. For example:

get /go/api/admin/templates/<template_name> HTTP/1.1
Host: target-gocd.example.com
Authorization: Bearer <low_priv_token>

Because the authorization filter lookup is case‑sensitive, it fails to associate this request with the filter that enforces the "view" permission, and the server processes the request as if no permission check were required.

4) Post‑exploitation impact: The attacker receives the configuration of the specified pipeline template. This configuration may reveal pipeline stages, jobs, tasks, material definitions, and environment variables (though secure variables remain encrypted). The attacker cannot modify data, nor can they decrypt secure variables. The primary impact is information disclosure: the attacker gains insight into the build and deployment logic, which can aid further attacks such as identifying credentials in plaintext, understanding deployment targets, or mapping the CI/CD environment.

Impact Assessment

The vulnerability allows an authenticated but under‑privileged user to read pipeline template configurations that they are not authorized to view. This is a confidentiality breach. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects that the attack is network‑reachable, low complexity, requires low privileges, needs no user interaction, and results in high confidentiality impact with no integrity or availability impact.

The blast radius is limited to the GoCD instance and the templates stored on it. Since the attacker must already have valid credentials, the threat is primarily from insider threats or from an external attacker who has compromised a low‑privileged account. The exposure of pipeline configurations can reveal sensitive information such as internal hostnames, repository URLs, deployment scripts, and potentially hardcoded secrets (if present in non‑secure variables). This information can be used to plan further attacks, such as lateral movement or supply chain compromise.

Detection Guidance

Sigma Rule

title: GoCD Get Template Config API Unauthorized Access via Lowercase HTTP Method
id: 5f3c2a1e-9b4d-4e7a-8c1f-2d3e4f5a6b7c
status: experimental
description: Detects requests to GoCD Get Template Config API using nonstandard HTTP method capitalization to bypass authorization
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: gocd
detection:
  selection_method:
    http.method|startswith: 'get'
    http.method|endswith: 'GET'  # to catch mixed case; adjust as needed
  selection_uri:
    http.url|contains: '/api/admin/templates/'
  condition: selection_method and selection_uri
falsepositives:
  - Legitimate clients using lowercase methods accidentally
level: high

YARA Rule

rule GoCD_CVE_2026_52740_Lowercase_Method
{
    meta:
        description = "Detects HTTP requests with lowercase 'get' to GoCD Get Template Config API"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-52740"
    strings:
        $method_lower = /get \/api\/admin\/templates\/[a-zA-Z0-9_\-]+ HTTP\/1\.[01]/
        $method_mixed = /[gG][eE][tT] \/api\/admin\/templates\/[a-zA-Z0-9_\-]+ HTTP\/1\.[01]/
    condition:
        $method_lower or $method_mixed
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52740 GoCD Get Template Config API Lowercase Method Bypass"; flow:to_server,established; http.method; content:"get"; nocase; http.uri; content:"/api/admin/templates/"; nocase; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

http where http.request.method in ("get", "Get", "gEt", "geT", "GEt", "GeT", "gET") and
  http.request.uri like "/api/admin/templates/*"

Splunk SPL Query

index=web sourcetype=access_combined
| search method IN ("get", "Get", "gEt", "geT", "GEt", "GeT", "gET")
| search uri_path="/api/admin/templates/*"
| stats count by src_ip, method, uri_path, status
| where status=200

Wazuh OSSEC Rule

<group name="gocd,web">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">^get$|^Get$|^gEt$|^geT$|^GEt$|^GeT$|^gET$</field>
    <field name="url">/api/admin/templates/</field>
    <description>CVE-2026-52740: GoCD API accessed with lowercase HTTP method</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• If possible, configure a reverse proxy (e.g., Nginx, Apache) to reject or normalize HTTP requests with non‑uppercase methods before they reach GoCD. The NVD description explicitly states that deployments whose reverse proxy rejects non‑uppercase HTTP methods are not affected.
• Enforce strict HTTP method validation at the edge: allow only GET, POST, PUT, DELETE, etc., in uppercase.
• Monitor access logs for suspicious lowercase or mixed‑case methods targeting API endpoints.

2) Patch/upgrade steps:

• The vulnerability is fixed in GoCD version 26.1.0. Upgrade to 26.1.0 or later as soon as possible. No official patch has been released for earlier versions; upgrading is the only vendor‑provided fix.
• Verify the installed version and plan an upgrade window. Since no patch is available for versions 18.7.0 to 26.1.0, upgrading to 26.1.0 is mandatory.

3) Long‑term hardening:

• Implement case‑insensitive authorization filter matching in custom code or wait for the fix.
• Conduct regular security reviews of authorization logic, especially for API endpoints.
• Apply the principle of least privilege to all accounts; avoid granting broad view permissions.
• Use a Web Application Firewall (WAF) with rules to normalize HTTP methods and block non‑standard methods.
• Monitor and audit API access, particularly for template configuration retrieval, to detect anomalous behavior.

References

1. NVD – CVE-2026-52740: https://nvd.nist.gov/vuln/detail/CVE-2026-52740
2. GoCD Official Website – Security Advisories: https://www.gocd.org/security/
3. GoCD GitHub Repository – Release Notes for 26.1.0: https://github.com/gocd/gocd/releases/tag/v26.1.0
4. CWE-863: Incorrect Authorization – https://cwe.mitre.org/data/definitions/863.html
5. MITRE ATT&CK T1190: Exploit Public-Facing Application – https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit‑in‑the‑wild evidence is available at this time. CISA KEV does not list this CVE.