https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 14:59:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-369077 EUVD-2026-369077 https://cve.radiocsirt.org/vuln/euvd-2026-369077 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61549 <p>Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account&#39;s RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.</p> <p>Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account&#39;s RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61549 https://cve.radiocsirt.org/vuln/ghsa-qf34-295c-26v8 <p><strong>Affected:</strong> Go: go.woodpecker-ci.org/woodpecker/v3, Go: github.com/woodpecker-ci/woodpecker, Go: go.woodpecker-ci.org/woodpecker/v2</p> <p>### Impact</p> <p>A privilege escalation vulnerability affects Woodpecker instances using the **Kubernetes backend**.</p> <p>The pipeline option `backend_options.kubernetes.serviceAccountName` was passed directly to the pod spec without any admin gating.</p> <p>**Who is impacted:** any operator running the Kubernetes backend. Any user with **Push** permission on a connected repository can run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace, gaining that account&#39;s RBAC permissions. If a privileged ServiceAccount is reachable in that namespace, this can lead to secret exfiltration (database credentials, API keys, TLS certs) and full cluster takeover.</p> <p>### Patches</p> <p>https://github.com/woodpecker-ci/woodpecker/pull/6792</p> <p>### Workarounds</p> <p>Operators who cannot upgrade immediately can mitigate by any of:</p> <p>- **Restrict Push access** on repositories connected to the Kubernetes-backed instance to trusted users only. - **Harden the pipeline namespace**: ensure no privileged ServiceAccount exists or is bound in the namespace where pipeline pods run; keep the `default` ServiceAccount minimally privileged. - **Disable ServiceAccount token automounting** for ServiceAccounts that should not be used by pipelines. - **Enforce an admission policy** (e.g. OPA/Gatekeeper, Kyverno, or a ValidatingAdmissionPolicy) that rejects pipeline pods setting an unexpected `serviceAccountName`. - **Use a dedicated, isolated namespace** per org/instance with no sensitive RBAC bindings.</p> <p>### Res…</p> <p><strong>Affected:</strong> Go: go.woodpecker-ci.org/woodpecker/v3, Go: github.com/woodpecker-ci/woodpecker, Go: go.woodpecker-ci.org/woodpecker/v2</p> <p>### Impact</p> <p>A privilege escalation vulnerability affects Woodpecker instances using the **Kubernetes backend**.</p> <p>The pipeline option `backend_options.kubernetes.serviceAccountName` was passed directly to the pod spec without any admin gating.</p> <p>**Who is impacted:** any operator running the Kubernetes backend. Any user with **Push** permission on a connected repository can run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace, gaining that account&#39;s RBAC permissions. If a privileged ServiceAccount is reachable in that namespace, this can lead to secret exfiltration (database credentials, API keys, TLS certs) and full cluster takeover.</p> <p>### Patches</p> <p>https://github.com/woodpecker-ci/woodpecker/pull/6792</p> <p>### Workarounds</p> <p>Operators who cannot upgrade immediately can mitigate by any of:</p> <p>- **Restrict Push access** on repositories connected to the Kubernetes-backed instance to trusted users only. - **Harden the pipeline namespace**: ensure no privileged ServiceAccount exists or is bound in the namespace where pipeline pods run; keep the `default` ServiceAccount minimally privileged. - **Disable ServiceAccount token automounting** for ServiceAccounts that should not be used by pipelines. - **Enforce an admission policy** (e.g. OPA/Gatekeeper, Kyverno, or a ValidatingAdmissionPolicy) that rejects pipeline pods setting an unexpected `serviceAccountName`. - **Use a dedicated, isolated namespace** per org/instance with no sensitive RBAC bindings.</p> <p>### Res…</p> https://cve.radiocsirt.org/vuln/ghsa-qf34-295c-26v8