CVE-2026-50141

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50141", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-03T18:49:32.275Z", "datePublished": "2026-06-18T14:13:38.065Z", "dateUpdated": "2026-06-18T16:10:41.914Z"}, "containers": {"cna": {"title": "Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h"}, {"name": "https://github.com/woodpecker-ci/woodpecker-security/issues/21", "tags": ["x_refsource_MISC"], "url": "https://github.com/woodpecker-ci/woodpecker-security/issues/21"}, {"name": "https://github.com/woodpecker-ci/woodpecker/issues/6541", "tags": ["x_refsource_MISC"], "url": "https://github.com/woodpecker-ci/woodpecker/issues/6541"}, {"name": "https://github.com/woodpecker-ci/woodpecker/pull/6567", "tags": ["x_refsource_MISC"], "url": "https://github.com/woodpecker-ci/woodpecker/pull/6567"}, {"name": "https://github.com/woodpecker-ci/woodpecker/pull/6569", "tags": ["x_refsource_MISC"], "url": "https://github.com/woodpecker-ci/woodpecker/pull/6569"}], "affected": [{"vendor": "woodpecker-ci", "product": "woodpecker", "versions": [{"version": ">= 3.0.0, < 3.14.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T14:13:38.065Z"}, "descriptions": [{"lang": "en", "value": "Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones."}], "source": {"advisory": "GHSA-g7mm-9vx7-jm7h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-18T15:21:39.524543Z", "id": "CVE-2026-50141", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T16:10:41.914Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T15:21:39.524543Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T15:21:44.965Z"}}], "cna": {"title": "Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation", "source": {"advisory": "GHSA-g7mm-9vx7-jm7h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "woodpecker-ci", "product": "woodpecker", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.14.1"}]}], "references": [{"url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h", "name": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/woodpecker-ci/woodpecker-security/issues/21", "name": "https://github.com/woodpecker-ci/woodpecker-security/issues/21", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/issues/6541", "name": "https://github.com/woodpecker-ci/woodpecker/issues/6541", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/pull/6567", "name": "https://github.com/woodpecker-ci/woodpecker/pull/6567", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/pull/6569", "name": "https://github.com/woodpecker-ci/woodpecker/pull/6569", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T14:13:38.065Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50141", "state": "PUBLISHED", "dateUpdated": "2026-06-18T16:10:41.914Z", "dateReserved": "2026-06-03T18:49:32.275Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-18T14:13:38.065Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "woodpecker", "vendor": "woodpecker-ci", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.14.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones."}, {"lang": "es", "value": "Woodpecker es un motor de CI/CD. A partir de la versi\u00f3n 3.0.0 y antes de la versi\u00f3n 3.14.1, una vulnerabilidad en la capa gRPC de Woodpecker CI permit\u00eda a cualquier agente autenticado suplantar a cualquier otro agente en el mismo servidor inyectando un valor \u2019agent_id\u2019 falsificado en los metadatos gRPC salientes. El servidor verificaba correctamente el token JWT pero luego descartaba la identidad del agente verificada en favor del valor proporcionado por el cliente. La versi\u00f3n 3.14.1 corrige el problema. Como soluci\u00f3n alternativa, deshabilite los agentes de la organizaci\u00f3n (\u2019WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true\u2019) y elimine los existentes."}], "id": "CVE-2026-50141", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50141", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-18T15:21:39.524543Z", "version": "2.0.3"}}]}, "published": "2026-06-18T14:17:29.400", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/woodpecker-ci/woodpecker-security/issues/21"}, {"source": "security-advisories@github.com", "url": "https://github.com/woodpecker-ci/woodpecker/issues/6541"}, {"source": "security-advisories@github.com", "url": "https://github.com/woodpecker-ci/woodpecker/pull/6567"}, {"source": "security-advisories@github.com", "url": "https://github.com/woodpecker-ci/woodpecker/pull/6569"}, {"source": "security-advisories@github.com", "url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.14.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "woodpecker", "source": "cna", "vendor": "woodpecker-ci"}, "product": "woodpecker", "vendor": "woodpecker-ci"}], "created": "2026-06-18T19:00:10.954676+00:00", "updated": "2026-06-18T19:15:02.433277+00:00", "vendors": ["woodpecker-ci", "woodpecker-ci$PRODUCT$woodpecker"]}