https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 26 Oct 2026 22:31:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-6380 EUVD-2026-6380 https://cve.radiocsirt.org/vuln/euvd-2026-6380 https://cve.radiocsirt.org/vuln/fkie_cve-2024-41121 <p>Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who&#39;s entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who&#39;s entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-41121 https://cve.radiocsirt.org/vuln/ghsa-xw35-rrcp-g7xm <p><strong>Affected:</strong> Go: go.woodpecker-ci.org/woodpecker/v2, Go: go.woodpecker-ci.org/woodpecker</p> <p>### Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who&#39;s entrypoint are overwritten.</p> <p>### Patches https://github.com/woodpecker-ci/woodpecker/pull/3933</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ **Enable the &#34;gated&#34; repo feature and review each change upfront**</p> <p>### References - https://github.com/woodpecker-ci/woodpecker/pull/3933 - https://github.com/woodpecker-ci/woodpecker-security/pull/11 - https://github.com/woodpecker-ci/woodpecker-security/issues/8 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924) - https://github.com/woodpecker-ci/woodpecker-security/issues/9 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924) - https://github.com/woodpecker-ci/woodpecker/issues/3924 (info will be published later once we got adoption of the update)</p> <p>### Credits</p> <p>- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG) - Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)</p> <p><strong>Affected:</strong> Go: go.woodpecker-ci.org/woodpecker/v2, Go: go.woodpecker-ci.org/woodpecker</p> <p>### Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who&#39;s entrypoint are overwritten.</p> <p>### Patches https://github.com/woodpecker-ci/woodpecker/pull/3933</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ **Enable the &#34;gated&#34; repo feature and review each change upfront**</p> <p>### References - https://github.com/woodpecker-ci/woodpecker/pull/3933 - https://github.com/woodpecker-ci/woodpecker-security/pull/11 - https://github.com/woodpecker-ci/woodpecker-security/issues/8 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924) - https://github.com/woodpecker-ci/woodpecker-security/issues/9 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924) - https://github.com/woodpecker-ci/woodpecker/issues/3924 (info will be published later once we got adoption of the update)</p> <p>### Credits</p> <p>- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG) - Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)</p> https://cve.radiocsirt.org/vuln/ghsa-xw35-rrcp-g7xm