CVE-2026-52743

4.3 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The flaw allows authenticated users to guess job IDs and retrieve status for jobs in pipelines they shouldn't have access to, potentially exposing sensitive information.
Exploitability: Exploitation requires authentication and knowledge of job IDs; guessing is feasible but may require some trial and error.
Blast radius: If exploited, the impact is limited to exposure of job names, state, progress timestamps, assigned agent details, and associated stages and pipelines.
Prioritized remediation: Upgrade to GoCD version 26.1.0 or later to mitigate this vulnerability.

auth-bypassinfo-leakweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-639, CWE-863

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.