What’s Vulnerable › Products
gocd vulnerabilities
33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your gocd version is affected
Latest gocd vulnerabilities
- CVE-2026-55632 — GoCD is vulnerable to authorization bypass via pipeline structure API (CVSS 4.3)
- CVE-2026-52744 — GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API (CVSS 5.3)
- CVE-2026-68919 — GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages (CVSS 7.0)
- CVE-2026-55870 — GoCD is vulnerable to credential exposure when admins insecurely configure material URLs (CVSS 2.3)
- CVE-2026-55625 — GoCD is vulnerable to authorization bypass via material connection test APIs (CVSS 4.9)
- CVE-2026-55060 — GoCD is vulnerable to authorization bypass via support process list API (CVSS 3.7)
- CVE-2026-52743 — GoCD before 26.1.0 is vulnerable to authorization bypass via job status API (CVSS 4.3)
- CVE-2026-52742 — GoCD is vulnerable to historical server configuration API authorization bypass (CVSS 5.1)
- CVE-2026-52741 — GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages (CVSS 7.5)
- CVE-2026-52740 — GoCD is vulnerable to pipeline template view API authorization bypass (CVSS 5.3)
- CVE-2024-56324 — GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins (CVSS 7.1)
- CVE-2024-56322 — GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality (CVSS 7.2)
- CVE-2024-56321 — GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access (CVSS 3.8)
- CVE-2024-56320 — GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user (CVSS 8.8)
- CVE-2024-28866 — GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up (CVSS 6.1)
- CVE-2023-28630 — Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd (CVSS 4.4)
- CVE-2023-28629 — Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd (CVSS 5.4)
- CVE-2022-39311 — Compromised agents may be able to execute remote code on GoCD Server (CVSS 8.8)
- CVE-2022-39310 — Malicious agent may be able to impersonate another agent in GoCD (CVSS 6.5)
- CVE-2022-39309 — GoCD server secret encryption/decryption key leaked to agents during material serialization (CVSS 6.5)
- CVE-2022-39308 — GoCD API authentication of user access tokens subject to timing attack during comparison (CVSS 5.9)
- CVE-2022-36088 — GoCD Windows installations outside default location inadequately restrict installation file permissions (CVSS 5.5)
- CVE-2022-29184 — Command Injection/Argument Injection in GoCD (CVSS 8.8)
- CVE-2022-29183 — Reflected XSS in GoCD (CVSS 6.1)
- CVE-2022-29182 — DOM-based XSS in GoCD (CVSS 5.4)