Shivamkumarcyber

**Name of the Vulnerable Software and Affected Versions** Woodpecker versions 3.0.0 through 3.14.0 **Description** A flaw in the gRPC layer of the CI/CD engine allows an authenticated agent to impersonate any other agent on the same server. This occurs because the server verifies the JWT (JSON Web Token) but subsequently ignores the verified identity, accepting a forged `agent id` value provided in the outgoing gRPC metadata instead. **Recommendations** Update to version 3.14.1. As a temporary workaround, disable organization agents by setting `WOODPECKER DISABLE USER AGENT REGISTRATION=true` and delete existing agents.