CVE-2026-55625

Name of the Vulnerable Software and Affected Versions GoCD versions 16.1.0 through 26.0.0

Description Internal material connection test APIs at '/go/api/admin/internal/material test' and '/go/api/internal/config repos/*/material test' accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. This allows a pipeline group administrator to invoke the Test Connection feature for source control materials outside their authorized pipeline group or configuration repository, potentially granting access to credentials from those materials. In versions 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions.

Recommendations Update GoCD to version 26.1.0.