CVE-2026-55625

Executive Summary

CVE-2026-55625 is an authorization bypass (CWE-639) in GoCD, a continuous delivery server, affecting versions from 16.1.0 until 26.1.0. The internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation, allowing a pipeline group administrator to test source control materials outside their authorized scope. Impact is confidentiality-only (CVSS 4.9): an attacker with high privileges can potentially use credentials from materials they are not authorized to access, and in GoCD 20.6.0 and later can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions.

Technical Analysis

GoCD exposes internal "Test Connection" functionality used to verify that source control materials (repositories) are reachable and that configured credentials are valid. Two API endpoints implement this functionality:

• /go/api/admin/internal/material_test
• /go/api/internal/config_repos/*/material_test

The vulnerability is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key). According to the NVD description, these endpoints "accept an arbitrary existing pipeline and pipeline-group context without sufficient validation." In other words, the request supplied by the caller includes a pipeline and pipeline-group context that the server uses to look up the material and its associated credentials — but the server fails to verify that the requesting user actually has administrative rights over that pipeline group or configuration repository.

Because the material lookup is driven by caller-supplied context rather than being derived from (and constrained to) the authenticated user's authorized resources, an actor holding the pipeline group administrator role for one group can reference a pipeline and pipeline group belonging to a different, unauthorized scope. The connection test then causes the server to resolve and use the credentials associated with the out-of-scope material.

For GoCD 20.6.0 and later, the description additionally states that the test context "can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions." This expands the disclosure surface: instead of only exposing a single repository's credentials, the test path can reach secrets held in external secret managers that were intended to be governed by their own, separate permission model.

Key characteristics derivable from the provided data:

• Attack vector: Network (AV:N), no user interaction (UI:N), high privileges required (PR:H).
• Confidentiality impact: High (C:H) — credentials/secrets can be accessed or used.
• Integrity and Availability impact: None (I:N/A:N), consistent with a read/test-only code path rather than a write path.
• The result is an information-and-credential exposure issue, not remote code execution.

Insufficient technical detail is available in the supplied data to describe the exact parameter names, request body schema, or the internal validation routine's implementation. Analysis should therefore remain at the vulnerability-class level: a user-controlled resource identifier (pipeline + pipeline group context) is trusted by the server without an authorization check binding it to the caller's permissions.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred from the vulnerability class (CWE-639) and the NVD description; it does not rely on any fabricated implementation details.

1. Reconnaissance / target identification An attacker must first possess valid credentials with the pipeline group administrator role on at least one pipeline group. GoCD instances are network-reachable web applications; the internal APIs are exposed under the /go/ context path. Target identification does not require exploiting the vulnerability — the attacker simply needs to know or discover the identifier of a pipeline and pipeline group that lies outside their authorized scope. GoCD's web UI and API commonly expose pipeline and pipeline group names to authenticated users, so enumerating candidate identifiers is typically low-effort for an insider with any administrative role.

2. Triggering the flawed class (authorization bypass via user-controlled key) The attacker sends a request to the material test endpoint — /go/api/admin/internal/material_test or /go/api/internal/config_repos/*/material_test — supplying a pipeline and pipeline-group context that belongs to a scope they do not administer. Because the endpoint "accepts an arbitrary existing pipeline and pipeline-group context without sufficient validation," the server does not reject the request on the basis that the caller lacks rights over the referenced scope. The vulnerability class is an authorization bypass keyed on a user-controlled identifier: the resource being acted upon is chosen by the requester, and the server fails to confirm the requester is authorized for that resource.

3. Payload / execution method (vulnerability-class level) The "payload" is a test-connection invocation parameterized with an out-of-scope pipeline and pipeline group reference. No memory corruption, injection string, or code payload is involved. For GoCD 20.6.0 and later, the same test context can additionally resolve external secrets via secret-management plugins, meaning the request can cause the server to dereference plugin-managed secrets — including global reusable secrets governed by separate permissions — as part of the connection test.

4. Post-exploitation impact The material test causes GoCD to resolve and use the credentials attached to the out-of-scope material. Depending on observability and response behavior, this can disclose or enable use of those credentials (source control credentials, and for 20.6.0+ external/global secrets). The result is credential and secret exposure across a trust boundary — lateral movement into other pipeline groups' repositories or into external secret managers. There is no integrity or availability impact per the CVSS vector; this is a disclosure and credential-abuse primitive, not a persistent code execution or data-destruction primitive.

Impact Assessment

The CVSS v3.1 base score is 4.9 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

• Attack Vector (Network): the vulnerable APIs are reachable over the network as part of the GoCD web application. Exploitation is remote; the attacker does not need local access.
• Attack Complexity (Low): once the required role is held and target identifiers are known, no special conditions or race windows are needed as described.
• Privileges Required (High): the attacker must already hold pipeline group administrator privileges. This limits the population of attackers to privileged insiders or accounts whose administrative scope has been delegated — a realistic and common operating model in large GoCD installations.
• User Interaction (None): no victim action is required.
• Scope (Unchanged): the vulnerable component's authorization boundary is broken, exposing resources the component is nevertheless capable of accessing.
• Confidentiality (High): credentials and, on GoCD 20.6.0+, secrets from secret-management plugins can be resolved and used. Credential exposure is generally a high-impact confidentiality event because it enables downstream access to source control systems and external secret stores.
• Integrity (None) / Availability (None): the test path does not modify or destroy data.

Blast radius: the immediate blast radius is bounded by the number of pipeline groups and materials the compromised administrator account can address. Because the flaw allows crossing pipeline-group and config-repo boundaries, the practical blast radius extends to all materials whose context can be referenced, and on 20.6.0+ to global reusable secrets and other plugin-managed secrets. There is no CISA KEV listing and no evidence of in-the-wild exploitation in the provided data, which lowers the current urgency but does not reduce the technical severity for orgs with broad secret sharing.

Business impact: unauthorized access to source control credentials can lead to unauthorized code access, tampering with or reading private repositories, and pivoting to build/release infrastructure. Exposure of global reusable secrets can cascade into third-party SaaS, cloud, and registry compromises. For regulated environments, this is a credentials-exposure incident requiring disclosure and rotation.

Detection Guidance

Sigma Rule

title: GoCD Material Test Authorization Bypass (CVE-2026-55625)
id: 9d4f7c2a-8b21-4e6a-9c37-go cd00000001
status: experimental
description: Detects requests to GoCD internal material test APIs that may abuse CWE-639 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55625
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: gocd
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/go/api/admin/internal/material_test'
      - '/go/api/internal/config_repos/'
  selection_material_test:
    cs-uri-stem|endswith: '/material_test'
  condition: selection_path or selection_material_test
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate administrators running Test Connection within their authorized pipeline group.
level: medium

YARA Rule

rule CVE_2026_55625_GoCD_Material_Test_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects GoCD material test API endpoints associated with CVE-2026-55625 authorization bypass"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55625"
        date = "2026-01-01"

    strings:
        $ep1 = "/go/api/admin/internal/material_test"
        $ep2 = "/go/api/internal/config_repos/"
        $s1 = "material_test"
        $p1 = "pipeline_group"
        $p2 = "pipeline_name"

    condition:
        any of ($ep*) or ($s1 and $p1) or ($s1 and $p2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55625 GoCD Material Test Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/material_test"; http.uri; content:"/go/api/"; distance:0; classtype:attempted-recon; sid:202655625; rev:1; reference:cve,2026-55625; metadata:affected_product GoCD, vulnerability_class Authorization_Bypass;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1m
  [http where url.path : ("/go/api/admin/internal/material_test", "/go/api/internal/config_repos/*/material_test")]

Note: correlate the material test request with the authenticated GoCD username, then review whether the referenced pipeline group is within that user's authorized group set.

Splunk SPL Query

index=web OR index=gocd sourcetype=access_combined OR sourcetype=gocd_server
| search uri_path IN ("/go/api/admin/internal/material_test") OR uri_path LIKE "/go/api/internal/config_repos/%/material_test"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints by src_ip, user
| where count > 0
| sort - count

Enrich with the pipelines/pipeline groups each user is authorized for; out-of-scope groupings indicate likely exploitation.

Wazuh OSSEC Rule

<group name="gocd,web,">
  <rule id="202655625" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/go/api/admin/internal/material_test</field>
    <description>CVE-2026-55625: GoCD internal material test API access (possible authorization bypass)</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
  <rule id="202655626" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/go/api/internal/config_repos/</field>
    <regex>material_test$</regex>
    <description>CVE-2026-55625: GoCD config repo material test API access (possible authorization bypass)</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The only version known to contain a fix per the NVD description is GoCD 26.1.0; no vendor advisory or standalone patch reference was present in the tracked patch sources.

1. Immediate mitigations

• Upgrade to GoCD 26.1.0 (the version identified in the description as containing the fix) as the primary action; confirm the installed version and take a tested backup before upgrading.
• If upgrade cannot occur immediately, restrict access to the affected internal endpoints (/go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test) at a reverse proxy or API gateway so that only strictly trusted administrators may call them.
• Audit and minimize the number of accounts holding pipeline group administrator privileges; reduce each account to the narrowest necessary group scope.
• On GoCD 20.6.0 and later, review secret-management plugin configuration and separate/segment global reusable secrets so that no single administrative role can transitively resolve secrets across unrelated scopes.
• Rotate source control credentials and any plugin-managed/global reusable secrets that were reachable by any account that could have exercised the flaw, as a precautionary measure.

2. Patch / upgrade steps

• Verify current version (check the GoCD server version in the UI or via its version endpoint), then upgrade to 26.1.0 or later following the official GoCD upgrade procedure.
• Because patch confidence is 0/4, treat 26.1.0 as the target but independently validate the fix against the vendor's release notes/advisory once published.
• After upgrading, re-test connection functionality within authorized scopes and confirm cross-scope references are rejected.
• Resume normal operations only after confirming the endpoint now enforces authorization on the caller-supplied pipeline/pipeline-group context.

3. Long-term hardening

• Adopt least privilege for GoCD roles; separate secret-management plugin permissions from pipeline group administration, consistent with the "separate permissions" model noted for global reusable secrets.
• Enforce object-level authorization checks in all internal APIs that accept user-controlled resource identifiers (CWE-639 class), and add regression tests for cross-tenant/cross-group references.
• Monitor and alert on material test invocations that reference pipeline groups outside the caller's authorized set (see Detection Guidance).
• Regularly rotate source control and secret-management credentials; centralize secret storage with scoped access and audit logging.
• Track GoCD advisories and subscribe to vendor security notifications; this CVE is not listed in CISA KEV and had no EPSS score at the time of writing.

References

• NVD — CVE-2026-55625: https://nvd.nist.gov/vuln/detail/CVE-2026-55625
• GoCD project / release information (verify 26.1.0 fix in official GoCD release notes and security advisories): https://www.gocd.org/
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-55625 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data for this CVE.