CVE-2026-58370 json
Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name
published 2026-06-30 4 mo ago modified 2026-11-08 24 h ago also EUVD-2026-40358
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing needsApproval to return false so the pipeline runs without the required approval. This defeats the fork-approval security boundary and allows execution of attacker-controlled pipeline steps on a Woodpecker agent and exfiltration of CI secrets exposed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pipeline.Author from the forge-validated sender/actor identity and are not affected.
Patch / fix
- woodpecker-ci woodpecker 3.15.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- woodpecker-ci woodpecker
Classification
- Weakness
-
- CWE-290 Authentication Bypass by Spoofing
References
-
github.com
/woodpecker-ci/woodpecker/pull/6653
issue-tracking, patch
-
github.com
/woodpecker-ci/woodpecker/commit/98faae778c953678944996c89ed99307d2f16a3d
patch
-
github.com
/woodpecker-ci/woodpecker/releases/tag/v3.15.0
release-notes
-
vulncheck.com
/advisories/woodpecker-gitlab-approval-gate-bypass-via-spoofable-commit-author-name
third-party-advisory
Sources
- CVE List CVE-2026-58370
- NVD CVE-2026-58370
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.