CVE-2026-55060

Name of the Vulnerable Software and Affected Versions GoCD versions 13.1.0 through 26.0.0

Description The /go/api/support/process list endpoint fails to enforce administrator-only authorization. This allows an authenticated internal user to query the endpoint during the execution of source control child processes to view command-line arguments, usernames, remote material URLs, and internal material paths for materials they are not authorized to access. Exploitation is dependent on unpredictable process timing, although credentials, environment variables, and user-defined secrets remain masked or omitted.

Recommendations Update to version 26.1.0. Restrict access to the /go/api/support/process list endpoint to minimize the risk of exploitation.