CVE-2026-61549

REPORT

Executive Summary

CVE-2026-61549 is an improper privilege management vulnerability (CWE-269) in the Woodpecker CI/CD engine affecting versions from 1.0.0 up to, but not including, 3.16.0. The Kubernetes backend copies a pipeline-step–controlled serviceAccountName value directly into the pod specification without administrator authorization, allowing any user with Push permission on a connected repository to execute pipeline pods under an arbitrary ServiceAccount within the pipeline namespace. Where a privileged ServiceAccount is reachable, an attacker can inherit that account's RBAC permissions, exfiltrate cluster secrets (database credentials, API keys, TLS certificates), and potentially take over the cluster.

Technical Analysis

Woodpecker is a CI/CD engine that executes pipelines against connected source repositories. The Kubernetes execution backend is responsible for translating a pipeline step into a Kubernetes pod specification. According to the NVD description, two components are relevant:

• pipeline/backend/kubernetes/backend_options.go defines the backend option backend_options.kubernetes.serviceAccountName.
• pipeline/backend/kubernetes/pod.go copies the value of that option directly into the pod specification.

The security defect is one of improper privilege management / missing authorization: the value of serviceAccountName is attacker-influenced (it originates from the pipeline step configuration) and is written into the pod spec with no administrator-level approval enforced by the backend. Because pod creation in Kubernetes binds the pod to the specified ServiceAccount, the pod inherits that ServiceAccount's RBAC permissions. In a cluster where a workload controller, CI controller, or other ServiceAccount holds broad read permissions on Secrets or other elevated rights, the pipeline pod inherits those rights implicitly.

Key characteristics of the flaw class:

• Trust boundary violation: pipeline-step configuration is trusted more than it should be; a repository-level user is elevated to the Kubernetes identity plane.
• Missing authorization check: the backend does not verify that the pipeline author is permitted to request the chosen ServiceAccount. The description states the copy happens "without administrator authorization."
• Primitive: arbitrary ServiceAccount selection within the pipeline namespace, which indirectly grants whatever RBAC the referenced account possesses.

The exploitability hinges on the presence of a ServiceAccount in the pipeline namespace that is reachable with meaningful RBAC. If only low-privilege ServiceAccounts exist in the namespace, the impact is correspondingly limited; the worst case (cluster takeover, secret exfiltration) requires a sufficiently privileged, reachable ServiceAccount. No public proof-of-concept, exploit code, or Nuclei template was identified for this CVE at the time of writing.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the NVD description. It uses only identifiers explicitly present in the description.

1. Reconnaissance / target identification. The attacker identifies a Woodpecker instance in the affected version range (1.0.0 to < 3.16.0) that uses the Kubernetes backend and is connected to a repository on which the attacker holds Push permission. Passively, the attacker enumerates candidate ServiceAccount names in the pipeline namespace (common CI/deploy account names) by observing or guessing existing RBAC principals; no cluster read access is required for this step.

2. Trigger of the specific flaw. The attacker commits pipeline configuration to a branch they can push to. That configuration sets the pipeline-step backend option backend_options.kubernetes.serviceAccountName to the name of a target ServiceAccount in the pipeline namespace. Because pod.go copies this value directly into the pod spec "without administrator authorization," the requirement that the pipeline author be permitted to use that account is never enforced.

3. Payload / execution method at the vulnerability-class level. When the pipeline runs, Woodpecker schedules a pod bound to the attacker-selected ServiceAccount. The pod's effective identity is now the target ServiceAccount, and any token mounted into the pod carries that account's RBAC. The attacker can run commands inside that pod context (for example, reading the mounted ServiceAccount token and calling the Kubernetes API) to act with the ServiceAccount's permissions. No invented APIs are required: the attack uses the standard Kubernetes identity-and-authorization mechanism (ServiceAccount tokens plus RBAC evaluation) that the backend failed to gate.

4. Post-exploitation impact. Using the inherited RBAC, the attacker can enumerate and exfiltrate cluster secrets such as database credentials, API keys, and TLS certificates, and — if the referenced ServiceAccount can create or modify workloads, roles, or role bindings — may escalate further and take over the cluster. Because pipeline configurations persist across runs, the attacker can repeat the technique as needed.

Impact Assessment

Because this is CWE-269 (Improper Privilege Management), the core impact is horizontal-to-vertical privilege escalation from a code-repository contributor to a Kubernetes identity. The attacker's baseline authority is "Push permission on a connected repository" — a low-privilege, commonly granted permission — while the impact is expressed in the cluster's confidentiality, integrity, and availability plane.

In CVSS v3.1 terms (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H):

• AV:N — the Woodpecker API/web surface is network-reachable; exploit is remote.
• AC:L — no special conditions beyond having a pushable repository and a reachable ServiceAccount.
• PR:L — requires Low privileges (repository Push), not admin.
• UI:N — no user interaction required beyond the attacker's own pipeline run.
• S:C — a successful attack crosses a security boundary: the Woodpecker pipeline tenant boundary into the Kubernetes identity/RBAC boundary.
• C:H / I:H / A:H — with a privileged ServiceAccount, the attacker can read cluster secrets (Confidentiality), alter workloads/resources subject to that account's RBAC (Integrity), and disrupt workloads (Availability).

Blast radius: single Woodpecker instance and its Kubernetes pipeline namespace, but escalating to the cluster scope whenever a sufficiently privileged ServiceAccount is reachable. Woodpecker's own EPSS score is 0.00166 (6.3rd percentile of exploited CVEs), and it is not listed in CISA KEV as of this writing — indicating low observed exploitation activity, not low impact. The real-world severity is highly environment-dependent: it is governed by which ServiceAccounts exist in the pipeline namespace and what RBAC they hold.

Detection Guidance

Sigma Rule

title: Woodpecker Kubernetes ServiceAccount Injection via Pipeline Configuration
id: 8b2f3c1e-6154-4d49-9a7f-woodpecker61549
status: experimental
description: Detects attempts to manipulate Woodpecker pipeline configuration to set an arbitrary Kubernetes serviceAccountName value, enabling privilege escalation per CVE-2026-61549.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61549
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  category: process_creation
  product: linux
detection:
  selection_ci:
    Image|endswith:
      - '/woodpecker-server'
      - '/woodpecker-agent'
  selection_sa:
    CommandLine|contains:
      - 'serviceAccountName'
      - 'backend_options.kubernetes.serviceAccountName'
  condition: selection_ci and selection_sa
falsepositives:
  - Legitimate administrators configuring ServiceAccount usage for pipelines
level: high

YARA Rule

rule CVE_2026_61549_Woodpecker_K8s_ServiceAccount_Injection
{
    meta:
        description = "Detects Woodpecker pipeline configs or logs referencing arbitrary Kubernetes serviceAccountName values (CVE-2026-61549)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61549"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a1 = "backend_options.kubernetes.serviceAccountName" ascii wide
        $a2 = "serviceAccountName" ascii wide
        $k1 = "kubernetes" ascii wide nocase
        $k2 = "pipeline" ascii wide nocase
        $k3 = "serviceAccount" ascii wide nocase

    condition:
        $a1 or ($a2 and 2 of ($k*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-61549 Woodpecker Kubernetes serviceAccountName injection attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"pipeline"; nocase; http.request_body; content:"serviceAccountName"; nocase; http.request_body; content:"kubernetes"; nocase; reference:cve,2026-61549; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-61549; classtype:attempted-admin; sid:202661549; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("woodpecker-server", "woodpecker-agent", "woodpecker") and
  process.command_line : ("*serviceAccountName*" or "*backend_options.kubernetes.serviceAccountName*")

Splunk SPL Query

index=* (sourcetype=woodpecker* OR sourcetype=kubernetes* OR source=*woodpecker*)
| search "serviceAccountName" ("kubernetes" OR "backend_options" OR "pipeline")
| stats count min(_time) as firstTime max(_time) as lastTime values(host) as hosts values(user) as users by src_ip, sourcetype, _raw
| where count > 0
| eval risk="CVE-2026-61549 Kubernetes ServiceAccount injection via Woodpecker pipeline"
| sort - count

Wazuh OSSEC Rule

<group name="woodpecker,cve-2026-61549,">
  <rule id="202661549" level="12">
    <decoded_as>json</decoded_as>
    <field name="log">\.</field>
    <match>serviceAccountName</match>
    <match>backend_options.kubernetes</match>
    <description>CVE-2026-61549: Woodpecker pipeline set an arbitrary Kubernetes serviceAccountName value - possible privilege escalation</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>attack,privilege_escalation,</group>
  </rule>
  <rule id="202661550" level="10">
    <decoded_as>json</decoded_as>
    <field name="log">\.</field>
    <match>serviceAccountName</match>
    <description>CVE-2026-61549: Possible Woodpecker Kubernetes ServiceAccount manipulation attempt</description>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations (apply before/absent patching).

   • Constrain RBAC in the Woodpecker pipeline namespace: remove or tightly scope ServiceAccounts that can read Secrets or manage workloads, and remove automountServiceAccountToken where pipelines do not need the Kubernetes API.
   • Audit every ServiceAccount reachable from the pipeline namespace and its bound roles/rolebindings; treat any account with access to cluster secrets as a priority risk.
   • Restrict which users hold Push permission on repositories connected to a Kubernetes-backed Woodpecker instance.
   • Where feasible, enforce Kubernetes admission policies that reject pods requesting unexpected or privileged ServiceAccounts in the Woodpecker namespace.

2. Patch / upgrade steps.

   • Upgrade Woodpecker to 3.16.0 or later, which the description states fixes this issue (affects 1.0.0 to < 3.16.0).
   • Verify the running image digest after upgrade and confirm the version string on the server/agent.
   • Re-run a review of ServiceAccount assignments to confirm the fix enforces administrator authorization for backend_options.kubernetes.serviceAccountName.

3. Long-term hardening.

   • Enforce least privilege for all CI/CD-related ServiceAccounts; separate build-time identities from deploy-time identities.
   • Apply namespace-level RBAC minimums and pod security controls, and monitor for unexpected pod creation bound to sensitive ServiceAccounts.
   • Monitor the Woodpecker project and OSV/NVD for confirmation of the 3.16.0 fix; because patch confidence is only 2/4, validate the fix behavior in a test cluster before relying on it alone.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61549
• Woodpecker project (upstream source and advisories): https://github.com/woodpecker-ci/woodpecker
• OSV entry (patch source for this CVE): https://osv.dev/
• CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• CISA Known Exploited Vulnerabilities catalog (check current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: none identified. CISA KEV status: NO. EPSS score: 0.00166 (6.3rd percentile). No public PoC, exploit code, or Nuclei template was available at the time of writing.