CVE-2026-61549— Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Quick assessment
Affected
woodpecker-ci woodpecker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Woodpecker 是一款 CI/CD 引擎。在 1.0.0 至 3.16.0 版本中，文件 定义了 配置项，而 Kubernetes 后端在 中会直接将该流水线步骤的值复制到 Pod 规范（spec）中，且未进行管理员授权校验。因此，任何对已连接仓库具有 Push 权限的用户，都可以在流水线命名空间下以任意 ServiceAccount 身份运行流水线 Pod，并继承该 ServiceAccount 的 RBAC 权限。若存在可访问的高权限 ServiceAccount，攻击者即可窃取机密信息（如数据库凭据、A
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61549
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Source: CVE Program / CVE List V5
Vulnerability Description
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| woodpecker-ci | woodpecker | >= 1.0.0, < 3.16.0 | - |
|
II. Public POCs for CVE-2026-61549
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61549
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-61549 (2)
Vendor Advisories for CVE-2026-61549 (1)
Vendor Pages for CVE-2026-61549 (1)
IV. Related Vulnerabilities
Same product: woodpecker
-
CVE-2026-58370
Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofa -
CVE-2026-58369
Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereferen -
CVE-2026-50141
Woodpecker gRPC agent_id metadata can be spoofed- cross-tena -
CVE-2024-41122
Custom environment variables allow to alter execution flow o -
CVE-2024-41121
Custom workspace allow to overwrite plugin entrypoint execut
Same vendor: woodpecker-ci
-
CVE-2026-58370
Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofa -
CVE-2026-58369
Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereferen -
CVE-2026-50141
Woodpecker gRPC agent_id metadata can be spoofed- cross-tena -
CVE-2024-41122
Custom environment variables allow to alter execution flow o -
CVE-2024-41121
Custom workspace allow to overwrite plugin entrypoint execut
Same weakness: CWE-269
-
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spe -
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace -
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/co -
CVE-2026-54168
Pipelines-as-Code: Unscoped GitHub App installation token al -
CVE-2026-14805
Consulting - Business, Finance WordPress Theme <= 6.7.16 - A
V. Comments for CVE-2026-61549
No comments yet