CVE-2026-55625

Summary

The flaw allows pipeline group administrators to test connections for source control materials outside their authorized scope, potentially exposing credentials. It also enables resolution of external secrets managed by secret-management plugins.

Exploitability

Exploitation requires access to a GoCD server and permissions as a pipeline group administrator; preconditions include the use of vulnerable GoCD versions before 26.1.0.

Blast radius

If exploited, this could lead to unauthorized access to sensitive credentials and secrets managed by secret-management plugins.

Prioritized remediation

Upgrade to GoCD version 26.1.0 or later to mitigate the risk.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.