CVE-2026-50141

Name of the Vulnerable Software and Affected Versions Woodpecker versions 3.0.0 through 3.14.0

Description A flaw in the gRPC layer of the CI/CD engine allows an authenticated agent to impersonate any other agent on the same server. This occurs because the server verifies the JWT (JSON Web Token) but subsequently ignores the verified identity, accepting a forged agent id value provided in the outgoing gRPC metadata instead.

Recommendations Update to version 3.14.1. As a temporary workaround, disable organization agents by setting WOODPECKER DISABLE USER AGENT REGISTRATION=true and delete existing agents.