CVE-2026-58369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58369", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-30T12:13:02.506Z", "datePublished": "2026-06-30T15:56:45.044Z", "dateUpdated": "2026-11-08T14:06:55.428Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:06:55.428Z"}, "datePublic": "2026-05-27T00:00:00.000Z", "title": "Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service", "descriptions": [{"lang": "en", "value": "Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser) when selecting the forge to query. For an unauthenticated request session.User returns nil, so any unauthenticated HTTP request triggers a NULL pointer dereference in the handler. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log. A low-bandwidth unauthenticated attacker can repeatedly probe the endpoint to flood the logs (about 37 lines per request), inflating disk usage and downstream log-ingestion cost and burying legitimate log events."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-476", "description": "NULL Pointer Dereference", "type": "CWE"}]}], "affected": [{"vendor": "woodpecker-ci", "product": "woodpecker", "defaultStatus": "unaffected", "packageURL": "pkg:github/woodpecker-ci/woodpecker", "versions": [{"version": "0", "status": "affected", "lessThan": "3.15.0", "versionType": "semver"}], "repo": "https://github.com/woodpecker-ci/woodpecker"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.15.0"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "references": [{"url": "https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.15.0", "name": "woodpecker 3.15.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/pull/6652", "name": "Fix PR", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/commit/1fbacac3a43b75b6e5a0a40a4f720a0017c62010", "name": "Fix Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/woodpecker-unauthenticated-null-pointer-dereference-in-api-orgs-lookup-enables-log-flooding-denial-of-service", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-30T17:52:17.979127Z", "id": "CVE-2026-58369", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T17:53:12.541Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T17:52:17.979127Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T17:53:06.716Z"}}], "cna": {"tags": ["x_open-source"], "title": "Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/woodpecker-ci/woodpecker", "vendor": "woodpecker-ci", "product": "woodpecker", "versions": [{"status": "affected", "version": "0", "lessThan": "3.15.0", "versionType": "semver"}], "packageURL": "pkg:github/woodpecker-ci/woodpecker", "defaultStatus": "unaffected"}], "datePublic": "2026-05-27T00:00:00.000Z", "references": [{"url": "https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.15.0", "name": "woodpecker 3.15.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/pull/6652", "name": "Fix PR", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/woodpecker-ci/woodpecker/commit/1fbacac3a43b75b6e5a0a40a4f720a0017c62010", "name": "Fix Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/woodpecker-unauthenticated-null-pointer-dereference-in-api-orgs-lookup-enables-log-flooding-denial-of-service", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser) when selecting the forge to query. For an unauthenticated request session.User returns nil, so any unauthenticated HTTP request triggers a NULL pointer dereference in the handler. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log. A low-bandwidth unauthenticated attacker can repeatedly probe the endpoint to flood the logs (about 37 lines per request), inflating disk usage and downstream log-ingestion cost and burying legitimate log events."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.15.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:06:55.428Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58369", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:06:55.428Z", "dateReserved": "2026-06-30T12:13:02.506Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-06-30T15:56:45.044Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/woodpecker-ci/woodpecker", "product": "woodpecker", "repo": "https://github.com/woodpecker-ci/woodpecker", "vendor": "woodpecker-ci", "versions": [{"lessThan": "3.15.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser) when selecting the forge to query. For an unauthenticated request session.User returns nil, so any unauthenticated HTTP request triggers a NULL pointer dereference in the handler. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log. A low-bandwidth unauthenticated attacker can repeatedly probe the endpoint to flood the logs (about 37 lines per request), inflating disk usage and downstream log-ingestion cost and burying legitimate log events."}, {"lang": "es", "value": "Woodpecker antes de la versi\u00f3n 3.15.0 registra el endpoint /api/orgs/lookup/org_full_name sin middleware de autenticaci\u00f3n, y el gestor LookupOrg desreferencia incondicionalmente al usuario de la sesi\u00f3n (user.ForgeID, a trav\u00e9s de ForgeFromUser) al seleccionar la forja a consultar. Para una solicitud no autenticada, session.User devuelve nil, por lo que cualquier solicitud HTTP no autenticada activa una desreferencia de puntero NULL en el gestor. El p\u00e1nico es recuperado por el middleware de recuperaci\u00f3n de gin y el servidor contin\u00faa sirviendo (devolviendo HTTP 500), pero cada solicitud escribe un rastreo de pila de p\u00e1nico de varias l\u00edneas en el registro de errores. Un atacante no autenticado de bajo ancho de banda puede sondear repetidamente el endpoint para inundar los registros (aproximadamente 37 l\u00edneas por solicitud), inflando el uso del disco y el costo de ingesta de registros posterior y enterrando eventos de registro leg\u00edtimos."}], "id": "CVE-2026-58369", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58369", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-30T17:52:17.979127Z", "version": "2.0.3"}}]}, "published": "2026-06-30T17:16:24.853", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/woodpecker-ci/woodpecker/commit/1fbacac3a43b75b6e5a0a40a4f720a0017c62010"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/woodpecker-ci/woodpecker/pull/6652"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.15.0"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/woodpecker-unauthenticated-null-pointer-dereference-in-api-orgs-lookup-enables-log-flooding-denial-of-service"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "woodpecker", "source": "cna", "vendor": "woodpecker-ci"}, "product": "woodpecker", "vendor": "woodpecker-ci"}], "created": "2026-06-30T17:30:15.286359+00:00", "updated": "2026-06-30T22:30:06.066856+00:00", "vendors": ["woodpecker-ci", "woodpecker-ci$PRODUCT$woodpecker"]}