All 7 CVE vulnerabilities found in woodpecker, with AI-generated Chinese analysis, references, and POCs.
Vendor: woodpecker-ci
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-61549 | Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend CWE-269 | 9.0 | Critical | 2026-09-15 |
| CVE-2026-58370 | Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name CWE-290 | 8.1 | High | 2026-06-30 |
| CVE-2026-58369 | Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service CWE-476 | 5.3 | Medium | 2026-06-30 |
| CVE-2026-50141 | Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation CWE-290 | - | - | 2026-06-18 |
| CVE-2024-41122 | Custom environment variables allow to alter execution flow of plugins in Woodpecker CWE-74 | 7.5 | High | 2024-07-19 |
| CVE-2024-41121 | Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker CWE-74 | 8.8 | High | 2024-07-19 |
| CVE-2023-40034 | Repositoty takeover in woodpecker-ci CWE-20 | 8.1 | High | 2023-08-16 |
All 7 known CVE vulnerabilities affecting woodpecker with full Chinese analysis, references, and POCs where available.