CVE-2026-55060

Executive Summary

CVE-2026-55060 is an improper authorization vulnerability in GoCD continuous delivery server affecting versions 13.1.0 through 25.x. The /go/api/support/process_list endpoint fails to enforce its intended administrator-only access control, allowing any authenticated internal user to view sensitive process information including command-line arguments, usernames, remote material URLs, and internal material paths. While exploitation requires specific timing conditions and yields only low confidentiality impact, it can expose sensitive infrastructure details to unauthorized users.

Technical Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), specifically a missing authorization check on a privileged API endpoint. GoCD exposes a support-oriented endpoint at /go/api/support/process_list that is designed to return diagnostic information about running system processes. The endpoint is intended to be restricted to administrator-level accounts but does not properly enforce this restriction, permitting any authenticated user (regardless of role) to invoke it.

The endpoint returns details about source control child processes spawned by GoCD's material polling subsystem. When these processes are actively running, the response includes:

• Command-line arguments passed to the source control binaries
• Usernames associated with those operations
• Remote material repository URLs
• Internal filesystem material paths

These data points would normally be visible only to administrators, as they reveal the topology of external repositories and internal paths the user may not have legitimate access to. The information disclosure is constrained: credentials, environment variables, and user-defined secrets remain masked or omitted by the endpoint's output logic.

The attack is opportunistic rather than deterministic. The endpoint only returns useful process data while source control child processes are active, which occurs at unpredictable intervals — typically during material polling cycles. An attacker must repeatedly query the endpoint and correlate responses over time to assemble a view of the target's material configuration. The CVSS vector reflects this: AC:H (High attack complexity) captures the timing dependency, while C:L (Low confidentiality impact) reflects the partial and inconsistent nature of the disclosure.

No public proof-of-concept, exploit code, or Nuclei template is available. Patch confidence is rated 0/4, meaning no tracked source has confirmed a patch, though the NVD description states the issue is fixed in version 26.1.0.

Exploitation Scenarios

No public PoC available; attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification An attacker obtains valid low-privilege credentials for a GoCD instance — for example, a compromised developer account, a service account with limited scope, or credentials obtained via credential stuffing or phishing. The attacker identifies the GoCD server by its known URL structure or via Shodan dorks targeting GoCD web interfaces. No special access to the admin console is required.

2. Triggering the Flaw Class The vulnerability class is a missing authorization check on a support endpoint. The attacker authenticates normally and sends HTTP GET requests directly to /go/api/support/process_list. Because the endpoint does not verify the caller's administrative role, the request is served despite the user lacking administrator permissions. The attacker must issue these requests repeatedly because the endpoint only returns populated process data while source control child processes are actively running — an inherently unpredictable window.

3. Data Retrieval at the Vulnerability-Class Level Once the timing alignment succeeds, the response body contains process listings including command-line arguments, usernames, remote material URLs, and internal material paths. The attacker harvests these responses and parses them for values such as repository hostnames, organizational usernames, and internal filesystem path structures. No payload injection or code execution occurs — this is a pure information disclosure via improper authorization.

4. Post-Exploitation Impact The collected data enables secondary attacks: remote material URLs and usernames can be used to map internal version control infrastructure (GitHub Enterprise, GitLab, Bitbucket, Perforce, etc.), craft spear-phishing against identified users, enumerate internal network paths for further traversal attempts, and inform credential-stuffing against adjacent systems. Because secrets and environment variables remain masked, the attacker cannot directly obtain credentials from this endpoint, but the metadata gathered materially improves reconnaissance for follow-on campaigns.

Impact Assessment

The CVSS 3.1 base score is 3.7 (Low) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Subscore analysis:

• AV:N (Network) — The endpoint is reachable over the network via the GoCD HTTP interface; no local access required.
• AC:H (High) — Successful exploitation depends on synchronizing requests with unpredictable source control child process execution windows.
• PR:N (None) — No privileges beyond an authenticated session are required; the flaw is the absence of required privileges.
• UI:N (None) — No user interaction is required on the target side.
• S:U (Unchanged) — Exploitation does not cross security boundaries; it only leaks data the endpoint already has access to.
• C:L (Low) — Partial confidentiality loss: sensitive metadata is disclosed but secrets, credentials, and environment variables are masked.
• I:N / A:N — No integrity or availability impact.

Business impact: An internal authenticated user — or an external attacker with stolen low-privilege credentials — can enumerate the organization's source control topology, internal hostnames, repository URLs, usernames, and filesystem paths. In regulated environments (PCI-DSS, HIPAA, SOC 2), unauthorized disclosure of internal infrastructure metadata may constitute a reportable incident. Blast radius is bounded to a single GoCD instance but scales across all materials configured on that server. The information gathered is valuable for lateral movement preparation, targeted phishing, and further credential attacks against adjacent VCS infrastructure.

Detection Guidance

Sigma Rule

title: GoCD Unauthorized Support Process List Endpoint Access
id: 8f4a2c1e-9b3d-4e7a-a1c5-6d2e8f9b0c3a
status: experimental
description: Detects non-administrator authenticated users accessing the GoCD /go/api/support/process_list endpoint, indicating potential exploitation of CVE-2026-55060.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55060
author: Threat Intelligence
date: 2026-01-15
tags:
    - attack.discovery
    - attack.t1087
    - cve.2026-55060
logsource:
    category: webserver
    product: gocd
detection:
    selection_endpoint:
        cs-uri-stem|contains: '/go/api/support/process_list'
    selection_method:
        cs-method: 'GET'
    condition: selection_endpoint and selection_method
fields:
    - c-ip
    - cs-username
    - cs-uri-stem
    - sc-status
falsepositives:
    - Legitimate administrator diagnostic activity
level: medium

YARA Rule

rule CVE_2026_55060_GoCD_ProcessList_Endpoint
{
    meta:
        description = "Detects references to the GoCD vulnerable support process_list endpoint in artifacts or logs"
        author = "Threat Intelligence"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55060"
        cve = "CVE-2026-55060"

    strings:
        $endpoint = "/go/api/support/process_list" ascii wide nocase
        $gocd = "GoCD" ascii wide nocase
        $procfield = "command-line" ascii wide nocase
        $matfield = "material" ascii wide nocase

    condition:
        $endpoint or ($gocd and $procfield and $matfield)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55060 GoCD Unauthorized process_list Endpoint Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/go/api/support/process_list"; nocase; http.uri; content:"/go/api/support/process_list"; nocase; fast_pattern; classtype:attempted-recon; reference:cve,2026-55060; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55060; sid:202655060; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where http.request.method == "GET" and
      http.request.uri : "/go/api/support/process_list" and
      http.response.status_code == 200 and
      not user.roles : "admin" ]

Splunk SPL Query

index=web sourcetype=gocd_access
    uri_path="/go/api/support/process_list" method=GET
    status=200
| stats count min(_time) as first_seen max(_time) as last_seen
        values(clientip) as src_ips
        values(user) as usernames
    by uri_path, user
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="gocd,web,cve-2026-55060,">
  <rule id="100560" level="8">
    <if_sid>31100</if_sid>
    <url>/go/api/support/process_list</url>
    <method>GET</method>
    <description>CVE-2026-55060: GoCD /go/api/support/process_list endpoint accessed - possible unauthorized process information disclosure.</description>
    <mitre>
      <id>T1087</id>
    </mitre>
    <group>cve_2026_55060,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Upgrade GoCD to version 26.1.0 or later. The NVD description states version 26.1.0 resolves the missing authorization check. Because patch confidence is 0/4 and no tracked source corroborates the vendor fix, verify the upgrade against the vendor's official release notes before relying on it operationally.
• If upgrading is not immediately possible, restrict network access to the /go/api/support/* path at the reverse proxy or WAF layer, allowing only trusted administrator source IPs.
• Audit all authenticated GoCD users and revoke or downgrade accounts that do not require access to the GoCD UI or API.
• Monitor access logs for repeated GET requests to /go/api/support/process_list from non-administrator accounts.

2. Patch / upgrade steps

• Verify the current GoCD version from the administrative dashboard or the server's version endpoint.
• Back up the GoCD configuration and database before upgrading.
• Follow the official GoCD upgrade procedure to move to 26.1.0 or the current stable release.
• After upgrading, test the endpoint with a low-privilege account to confirm that authorization is now enforced (expected response: HTTP 403).
• Review historical access logs for evidence of prior exploitation during the exposure window.

3. Long-term hardening

• Enforce role-based access control reviews on a recurring schedule, ensuring the principle of least privilege for all GoCD users.
• Implement centralized logging and alerting for all /go/api/support/* endpoint access, regardless of account role.
• Deploy the Sigma, Suricata, and Wazuh detections above into the SIEM/SOC pipeline.
• Require multi-factor authentication for all GoCD accounts to reduce the value of stolen low-privilege credentials.
• Segment GoCD servers from general developer workstations and enforce egress filtering so that exposed material URLs cannot be directly reached by unauthorized users.

References

1. NVD — CVE-2026-55060: https://nvd.nist.gov/vuln/detail/CVE-2026-55060
2. GoCD Official Website and Release Notes: https://www.gocd.org/
3. MITRE ATT&CK — T1087 Account Discovery: https://attack.mitre.org/techniques/T1087/
4. CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. FIRST EPSS — not yet scored for this CVE (do not assume a score)

Threat actor / exploit-in-the-wild status: No exploit code, PoC, or Nuclei template is publicly available. No CISA KEV entry exists for this CVE. No threat actor campaigns have been attributed to exploitation of CVE-2026-55060 at the time of writing.