What’s Vulnerable › Products

woodpecker-ci woodpecker vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your woodpecker-ci woodpecker version is affected

Latest woodpecker-ci woodpecker vulnerabilities

• CVE-2026-61549 — Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend (CVSS 9.0)
• CVE-2026-58370 — Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name (CVSS 8.1)
• CVE-2026-58369 — Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service (CVSS 5.3)
• CVE-2026-50141 — Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation (CVSS 7.1)
• CVE-2024-41122 — Custom environment variables allow to alter execution flow of plugins in Woodpecker (CVSS 8.8)
• CVE-2024-41121 — Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker (CVSS 8.8)
• CVE-2023-40034 — Repositoty takeover in woodpecker-ci (CVSS 8.1)
• CVE-2022-29947 — (CVSS 6.1)