CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
Authenticated users can read unmasked credentials from insecurely configured source control material URLs in GoCD.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55870?
CVE-2026-55870 is a low-severity vulnerability in gocd, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.
Which versions are affected by CVE-2026-55870?
How do I fix CVE-2026-55870?
No fix has been published for CVE-2026-55870 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55870 being exploited?
There is no known exploitation of CVE-2026-55870 in the wild and no public exploit code.
Sources
Also known as GHSA-5m25-5j77-c887.