CVE-2026-52742

Executive Summary

CVE-2026-52742 is an authorization bypass vulnerability in GoCD, a continuous delivery server, affecting versions from 12.3.1 until 26.1.0. The flaw is a CWE-863 (Incorrect Authorization) issue where legacy RESTful routes under /go/admin/restful/* expose historical full server configuration to pipeline group administrators rather than restricting responses to only the groups they administer. A malicious pipeline group administrator can exploit the disclosed configuration—which may include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists—to potentially connect a rogue agent and interfere with other groups' work or artifacts.

Technical Analysis

The vulnerability exists in GoCD's legacy administrative REST endpoints located under the /go/admin/restful/* path. These routes are intended to serve configuration data to authenticated users with administrative privileges. The core issue is an incorrect authorization check: when a pipeline group administrator accesses these legacy routes, the server returns the historical full server configuration instead of filtering the response to include only the resources belonging to the pipeline groups they administer. This violates the principle of least privilege and constitutes a CWE-863 weakness.

The exposed configuration data can include several highly sensitive items:

• Agent auto-registration keys: Credentials that allow a compatible GoCD agent to automatically register with the server without manual approval.
• Webhook invocation keys: Secrets used to authenticate incoming webhook triggers, potentially allowing unauthorized pipeline executions.
• Encrypted material credentials: Encrypted secrets used by pipelines (e.g., for source control, deployment targets).
• GoCD administrator lists: Enumeration of privileged accounts, useful for further targeting.

The attack surface is the GoCD web interface, specifically the legacy REST API. The vulnerability requires the attacker to already possess valid credentials for a pipeline group administrator account. It does not affect normal authenticated users, and the endpoint does not modify server configuration. Deployments that restrict pipeline editing to full administrators or configuration repositories are not affected because pipeline group administrators would not exist as a distinct role in those setups.

The flaw has been present since at least version 12.3.1 and was fixed in version 26.1.0. The fix likely introduces proper authorization checks on the legacy routes, ensuring responses are scoped to the requesting administrator's pipeline groups.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-52742. The following attack chain is inferred from the vulnerability class and the details provided in the NVD description.

1. Reconnaissance and target identification: An attacker gains initial access to a GoCD instance with a low-privileged account that has been granted pipeline group administrator rights. This could be achieved through credential theft, social engineering, or as a malicious insider. The attacker identifies the GoCD version as being between 12.3.1 and 26.1.0, indicating the vulnerability is present.

2. Triggering the flaw: The attacker sends an authenticated HTTP request to one of the legacy routes under /go/admin/restful/*. Because the authorization check is flawed, the server responds with the full historical server configuration rather than a filtered subset. The attacker does not need to craft a special payload; a standard GET request to the vulnerable endpoint suffices. The response includes configuration data for pipeline groups outside the attacker's administrative scope.

3. Payload/execution method: The attacker extracts sensitive values from the response, such as agent auto-registration keys. Using these keys, the attacker can configure and launch a rogue GoCD agent that automatically registers with the target server. This rogue agent is then treated as a legitimate agent, allowing the attacker to receive work from pipelines belonging to other groups or to overwrite artifacts associated with those groups. The attacker may also use webhook invocation keys to trigger pipelines or leverage encrypted material credentials if they can decrypt them (though encryption may provide some protection, the keys themselves are exposed).

4. Post-exploitation impact: With a rogue agent connected, the attacker can intercept build jobs, inject malicious code into artifacts, or disrupt the CI/CD pipeline. This can lead to supply chain compromise, unauthorized code deployment, or data exfiltration. The attacker can also enumerate administrator accounts from the disclosed list for further targeting.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The CVSS v3.1 base score is not provided by the NVD, but based on the description, a reasonable vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. This reflects:

• Attack Vector (AV): Network — exploitable remotely via HTTP.
• Attack Complexity (AC): Low — no special conditions beyond valid credentials.
• Privileges Required (PR): Low — attacker needs a pipeline group administrator account.
• User Interaction (UI): None — no victim action required.
• Scope (S): Unchanged — the vulnerable component and impacted component are the same.
• Confidentiality (C): High — full server configuration and secrets are exposed.
• Integrity (I): Low — rogue agent can overwrite artifacts, but the endpoint itself does not modify server configuration.
• Availability (A): None — no direct availability impact.

The business impact is significant for organizations using GoCD for continuous delivery. Exposure of agent registration keys and webhook secrets can lead to unauthorized pipeline execution, artifact tampering, and potential supply chain attacks. The blast radius includes all pipelines and artifacts managed by the GoCD server, especially those belonging to other pipeline groups. The vulnerability is not known to be exploited in the wild, and no CISA KEV entry exists.

Detection Guidance

Sigma Rule

title: GoCD Legacy RESTful Authorization Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects access to legacy GoCD admin RESTful endpoints that may expose full server configuration to pipeline group administrators.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52742
author: Threat Intelligence
date: 2026/05/12
tags:
  - attack.credential_access
  - attack.t1078
logsource:
  category: web
  product: gocd
detection:
  selection:
    cs-uri-stem|startswith: '/go/admin/restful/'
    cs-method: 'GET'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate administrative access by full administrators
level: medium

YARA Rule

rule CVE_2026_52742_GoCD_Config_Exposure
{
    meta:
        description = "Detects GoCD configuration data exposed via legacy RESTful endpoints"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52742"
        severity = "high"
    strings:
        $s1 = "agentAutoRegisterKey" ascii wide nocase
        $s2 = "webhookSecret" ascii wide nocase
        $s3 = "encryptedPassword" ascii wide nocase
        $s4 = "admins" ascii wide nocase
        $s5 = "/go/admin/restful/" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-52742 GoCD Legacy RESTful Authorization Bypass Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/go/admin/restful/"; http_uri; nocase; classtype:attempted-recon; sid:10000001; rev:1; reference:cve,2026-52742;)

Elastic Detection

sequence by host.hostname
  [http where http.request.method == "GET" and url.path startswith "/go/admin/restful/"]
  [http where http.response.status_code == 200 and url.path startswith "/go/admin/restful/"]

Splunk SPL Query

index=web sourcetype=gocd_access
| search uri_path="/go/admin/restful/*" method=GET status=200
| stats count by src_ip, uri_path, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="gocd,">
  <rule id="100001" level="7">
    <decoded_as>json</decoded_as>
    <field name="url">/go/admin/restful/</field>
    <field name="method">GET</field>
    <description>CVE-2026-52742: Possible GoCD legacy RESTful authorization bypass attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the GoCD server to trusted IP ranges only.
   • Audit pipeline group administrator accounts and reduce their number to the minimum necessary.
   • If possible, disable or restrict access to legacy routes under /go/admin/restful/* using a reverse proxy or web application firewall.
   • Monitor logs for unusual access to /go/admin/restful/* endpoints, especially from pipeline group administrators.
   • Rotate agent auto-registration keys, webhook invocation keys, and any potentially exposed credentials.

2. Patch/upgrade steps:

   • Upgrade GoCD to version 26.1.0 or later, where the vulnerability is fixed.
   • After upgrading, verify that legacy routes are properly restricted and no longer expose full configuration data to pipeline group administrators.
   • Refer to the official GoCD release notes for version 26.1.0 for detailed patch information.

3. Long-term hardening:

   • Implement role-based access control (RBAC) with least privilege, ensuring pipeline group administrators can only access their own groups' configurations.
   • Regularly review and rotate all secrets and keys used by GoCD.
   • Conduct periodic security audits of CI/CD infrastructure, including legacy endpoints.
   • Consider deploying GoCD in a segmented network with strict firewall rules.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52742
• GoCD Security Advisory: https://www.gocd.org/security/ (check for specific advisory for CVE-2026-52742)
• GoCD Release Notes 26.1.0: https://github.com/gocd/gocd/releases/tag/v26.1.0
• CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078: Valid Accounts: https://attack.mitre.org/techniques/T1078/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at this time.