CVE-2026-55870
Executive Summary
CVE-2026-55870 is an information disclosure vulnerability in GoCD, a continuous delivery server, affecting versions prior to 26.1.0. The flaw allows any authenticated user with access to an affected pipeline to retrieve unmasked credentials embedded in the userinfo portion of source control material URLs via multiple read-only APIs that do not consistently apply URL masking. This exposes sensitive credentials to unauthorized parties, potentially enabling lateral movement or further compromise of connected systems. The vulnerability is rated as unpatched with no public proof-of-concept, exploit code, or CISA KEV listing at this time.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
GoCD stores source control material configurations, including repository URLs. In legacy configurations, administrators may embed credentials directly in the userinfo portion of these URLs (e.g., https://username:password@git.example.com/repo.git). Although GoCD recommends using dedicated username/password fields or secret-management plugins, the legacy URL-based approach remains supported. The vulnerability arises because several read-only APIs—accessible to regular authenticated users—fail to consistently mask these embedded credentials when returning material information.
The root cause is an inconsistency in URL masking logic across different API endpoints and material types. While some APIs may properly redact credentials, others return the full URL including the userinfo component. This allows an authenticated user who has access to a pipeline (and thus can query its materials) to obtain credentials that were intended to be secret. Dedicated password fields are encrypted and are not affected by this issue. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS vector indicating network exploitable, low complexity, low privileges required, and high confidentiality impact.
The attack surface includes all GoCD instances running versions prior to 26.1.0 that have pipelines configured with source control materials using embedded credentials in URLs. The inconsistency in masking across APIs means that even if some endpoints are secure, others may leak the same credentials. No specific API endpoints or code functions are named in the available description, so the exact list of affected APIs cannot be enumerated from this data alone.
Exploitation Scenarios
No public proof-of-concept is available; the attack chain is inferred from the vulnerability class.
Reconnaissance/target identification: An attacker first identifies a GoCD instance, typically accessible over the network. They may use Shodan dorks such as
http.title:"GoCD"to locate exposed servers. The attacker must obtain valid credentials for a low-privileged user account, either through phishing, credential stuffing, or other means, or they may already be an insider with legitimate access.Triggering the flaw: Once authenticated, the attacker enumerates pipelines they have access to. For each pipeline, they query the read-only APIs that return material information. Due to inconsistent masking, some of these API responses will include the full URL of source control materials, including the userinfo portion with embedded credentials (e.g.,
https://username:password@git.example.com/repo.git). The attacker extracts these credentials.Payload/execution method: This is a passive information disclosure vulnerability; no payload is executed on the GoCD server. The "execution" is simply the API request and parsing of the response. The attacker may script the enumeration of multiple pipelines and APIs to maximize credential harvesting.
Post-exploitation impact: The harvested credentials can be used to access the source control repositories, potentially leading to source code theft, injection of malicious code, or further lateral movement within the organization's infrastructure. If the same credentials are reused elsewhere, the scope of compromise may expand. The attacker could also modify build configurations or introduce backdoors into the CI/CD pipeline.
Impact Assessment
The vulnerability allows an authenticated user with access to an affected pipeline to obtain credentials embedded in material URLs. This can lead to unauthorized access to source control systems, potentially exposing proprietary source code, enabling code tampering, and facilitating supply chain attacks. The blast radius depends on the privileges associated with the exposed credentials; if they are highly privileged (e.g., repository admin), the impact could be severe. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact but no integrity or availability impact. The EPSS score is not yet available, and the vulnerability is not listed in CISA KEV, suggesting no known active exploitation in the wild at this time. However, the lack of public exploit code does not preclude targeted attacks.
Detection Guidance
Sigma Rule
title: GoCD Credential Exposure via Read-Only APIs
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to GoCD read-only APIs that may return unmasked credentials in material URLs.
author: Threat Intelligence
date: 2026-01-01
logsource:
category: webserver
product: gocd
detection:
selection:
cs-method: 'GET'
cs-uri-query|contains:
- '/api/materials'
- '/api/pipelines'
- '/api/config'
sc-status: 200
condition: selection
falsepositives:
- Legitimate administrative access to these APIs.
level: medium
YARA Rule
rule CVE_2026_55870_GoCD_Credential_Exposure
{
meta:
description = "Detects GoCD API responses containing unmasked credentials in material URLs"
author = "Threat Intelligence"
date = "2026-01-01"
reference = "CVE-2026-55870"
severity = "high"
strings:
$url_pattern = /https?:\/\/[^\/\s]+:[^\/\s]+@[^\/\s]+/
$api_path1 = "/api/materials"
$api_path2 = "/api/pipelines"
$api_path3 = "/api/config"
condition:
any of ($api_path*) and $url_pattern
}
Suricata IDS Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-55870 GoCD Credential Exposure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/"; http_uri; content:"materials"; http_uri; content:"pipelines"; http_uri; content:"config"; http_uri; pcre:"/\/api\/(materials|pipelines|config)/Ui"; classtype:attempted-recon; sid:10000001; rev:1;)
Elastic Detection
sequence by user.name
[http where http.request.method == "GET" and http.request.uri : ("/api/materials*" or "/api/pipelines*" or "/api/config*") and http.response.status_code == 200]
[http where http.request.method == "GET" and http.response.body : "*://*:*@*" and http.response.status_code == 200]
Splunk SPL Query
index=web sourcetype=access_combined
| search method=GET uri_path IN ("/api/materials*", "/api/pipelines*", "/api/config*") status=200
| rex field=response_body "(?<url>https?://[^/]+:[^/]+@[^/]+)"
| where isnotnull(url)
| table _time, src_ip, user, uri_path, url
Wazuh OSSEC Rule
<group name="gocd,">
<rule id="100001" level="10">
<decoded_as>json</decoded_as>
<field name="http.method">GET</field>
<field name="http.url">/api/materials|/api/pipelines|/api/config</field>
<field name="http.status_code">200</field>
<description>Possible GoCD credential exposure via read-only API</description>
<mitre>
<id>T1552</id>
</mitre>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).
Immediate mitigations:
- Restrict network access to GoCD APIs to trusted IP ranges.
- Audit all source control material URLs for embedded credentials and replace them with dedicated username/password fields or secret-management plugins.
- Enforce strong authentication and least privilege for GoCD user accounts.
- Monitor API access logs for unusual patterns of material enumeration.
Patch/upgrade steps:
- Upgrade to GoCD version 26.1.0 or later as soon as it is available. Since no patch evidence exists from tracked sources, verify the official GoCD release notes and security advisories for the fix.
Long-term hardening:
- Adopt secret-management plugins for all credential storage.
- Implement consistent URL masking across all APIs, and conduct regular code reviews for credential handling.
- Rotate any credentials that may have been exposed.
- Integrate CI/CD security scanning into the development lifecycle.
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55870
- GoCD Security Advisories: https://www.gocd.org/security/
- CWE-200: https://cwe.mitre.org/data/definitions/200.html
- MITRE ATT&CK T1552: https://attack.mitre.org/techniques/T1552/
- No known threat actor campaigns or exploit-in-the-wild evidence available at this time.
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.