CyberRota Analysis
AI-GeneratedGoCD prior to version 26.1.0 is vulnerable as it can expose unmasked credentials stored in the userinfo section of source control material URLs through various read-only APIs accessible to authenticated users. This could allow an attacker with access to an affected pipeline to retrieve sensitive credentials, while dedicated password fields remain secure. Organizations using GoCD, especially those with legacy configurations that permit credentials in material URLs, should prioritize upgrading to version 26.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.