Woodpecker-ci vulnerabilities
We track 6 vulnerabilities in Woodpecker-ci products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Woodpecker-ci vulnerabilities
- 9.0 Critical severity
woodpecker: Improper Privilege Management
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value direct
- 8.1 High severity
woodpecker: Authentication Bypass by Spoofing
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-cont
- 7.1 High severity
woodpecker: Authentication Bypass by Spoofing
Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into out
- 8.8 High severity
woodpecker: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow.
- 8.8 High severity
woodpecker: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow.
- 8.1 High severity
Woodpecker is a community fork of the Drone CI system.
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured fo