CVE-2026-58369
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Woodpecker before version 3.15.0 exposes the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID via ForgeFromUser) when selecting the forge to query. For an unauthenticated request, session.User returns nil, causing a NULL pointer dereference and panic. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log.
Risk Assessment
An unauthenticated attacker can repeatedly probe the endpoint, causing approximately 37 lines of panic stack trace per request, leading to excessive disk usage, increased log ingestion costs, and burying legitimate log events.
Recommendation
Immediately upgrade Woodpecker to version 3.15.0 or later, which includes the fix for this vulnerability. As a temporary workaround, restrict access to the /api/orgs/lookup/* endpoint using firewall rules or a reverse proxy.
Other vulnerabilities in Woodpecker
See all- CVE-2026-61549Critical
Woodpecker, a CI/CD engine, from 1.0.0 until 3.16.0 allows any user with Push permission on a connected repository to run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace without administrator authorization. This enables inheriting that account's RBAC permissions and potentially taking over the cluster. The issue is fixed in version 3.16.0.
- CVE-2026-58370High
A vulnerability in Woodpecker before version 3.15.0 allows bypassing the ApprovalAllowedUsers list by manipulating the pipeline.Author field. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) in the webhook payload, which is attacker-controlled and not verified by GitLab. A user opening a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false and the pipeline to run without required approval.
Original NVD description (English source)
Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser) when selecting the forge to query. For an unauthenticated request session.User returns nil, so any unauthenticated HTTP request triggers a NULL pointer dereference in the handler. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log. A low-bandwidth unauthenticated attacker can repeatedly probe the endpoint to flood the logs (about 37 lines per request), inflating disk usage and downstream log-ingestion cost and burying legitimate log events.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS