CVE-2026-58370

Name of the Vulnerable Software and Affected Versions Woodpecker versions prior to 3.15.0

Description When using the GitLab forge driver, the system matches the ApprovalAllowedUsers bypass list against the pipeline.Author variable. The pipeline.Author is populated from the commit.author.name provided in the webhook payload, which is controlled by the user and not verified by GitLab. An attacker capable of opening a merge request from a fork can spoof the commit author name to match an entry in ApprovalAllowedUsers. This causes the needsApproval() function to return false, bypassing the fork-approval security boundary. Consequently, this allows the execution of unauthorized pipeline steps on a Woodpecker agent and the potential exfiltration of CI secrets exposed to the run.

Recommendations Update to version 3.15.0 or later.