Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

go.woodpecker-ci.org/woodpecker/v3

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1GoPublished

    Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

    CVE-2026-50141 · GHSA-g7mm-9vx7-jm7h

    Affected
    • Go go.woodpecker-ci.org/woodpecker/v3 >= 3.0.0, < 3.14.1
    Fixed in
    3.14.1· Vendor fix available
    Issue
    Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agentid value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Patches Direct patch: https://github.com/woodpecker-ci/woodpecker/pull/6567 Later proper fix: https://github.com/woodpecker-ci/woodpecker/pull/6569 Workarounds Disable org agents (WOODPECKERDISABLEUSERAGENTREGISTRATION=true) and delete existing ones Resources Public ref: https://github.com/woodpecker-ci/woodpecker/issues/6541 Private com: https://github.com/woodpecker-ci/woodpecker-security/issues/21

    Recommended action: Upgrade to 3.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →