# gocd.

Every CVE that names gocd among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [GoCD is vulnerable to authorization bypass via pipeline structure API](https://agentprime.io/advisories/CVE-2026-55632.md)
  `CVE-2026-55632` · CVE record: gocd gocd · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API](https://agentprime.io/advisories/CVE-2026-52744.md)
  `CVE-2026-52744` · CVE record: gocd gocd · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [GoCD is vulnerable to historical server configuration API authorization bypass](https://agentprime.io/advisories/CVE-2026-52742.md)
  `CVE-2026-52742` · CVE record: gocd gocd · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [GoCD is vulnerable to credential exposure when admins insecurely configure material URLs](https://agentprime.io/advisories/CVE-2026-55870.md)
  `CVE-2026-55870` · CVE record: gocd gocd · CVSS 2.3 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [GoCD is vulnerable to authorization bypass via material connection test APIs](https://agentprime.io/advisories/CVE-2026-55625.md)
  `CVE-2026-55625` · CVE record: gocd gocd · CVSS 4.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [GoCD is vulnerable to pipeline template view API authorization bypass](https://agentprime.io/advisories/CVE-2026-52740.md)
  `CVE-2026-52740` · CVE record: gocd gocd · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [GoCD is vulnerable to authorization bypass via support process list API](https://agentprime.io/advisories/CVE-2026-55060.md)
  `CVE-2026-55060` · CVE record: gocd gocd · CVSS 3.7 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages](https://agentprime.io/advisories/CVE-2026-52741.md)
  `CVE-2026-52741` · CVE record: gocd gocd · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages](https://agentprime.io/advisories/CVE-2026-68919.md)
  `CVE-2026-68919` · CVE record: gocd gocd · CVSS 7.0 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GoCD before 26.1.0 is vulnerable to authorization bypass via job status API](https://agentprime.io/advisories/CVE-2026-52743.md)
  `CVE-2026-52743` · CVE record: gocd gocd · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins](https://agentprime.io/advisories/CVE-2024-56324.md)
  `CVE-2024-56324` · CVE record: gocd gocd · CVSS 2.1 Low · Not analysed yet · Published 3 Jan 2025 · Tags: XML external entities (XXE)
- [GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality](https://agentprime.io/advisories/CVE-2024-56322.md)
  `CVE-2024-56322` · CVE record: gocd gocd · CVSS 2.1 Low · Not analysed yet · Published 3 Jan 2025 · Tags: XML external entities (XXE)
- [GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access](https://agentprime.io/advisories/CVE-2024-56321.md)
  `CVE-2024-56321` · CVE record: gocd gocd · CVSS 3.8 Low · Not analysed yet · Published 3 Jan 2025 · Tags: Path traversal, CWE-20
- [GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user](https://agentprime.io/advisories/CVE-2024-56320.md)
  `CVE-2024-56320` · CVE record: gocd gocd · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jan 2025 · Tags: Broken access control
- [GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up](https://agentprime.io/advisories/CVE-2024-28866.md)
  `CVE-2024-28866` · CVE record: gocd gocd · CVSS 3.1 Low · Not analysed yet · Published 13 May 2024 · Tags: Cross-site scripting (XSS)
- [Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd](https://agentprime.io/advisories/CVE-2023-28629.md)
  `CVE-2023-28629` · CVE record: gocd gocd · CVSS 5.4 Medium · Not analysed yet · Published 27 Mar 2023 · Tags: Cross-site scripting (XSS)
- [Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd](https://agentprime.io/advisories/CVE-2023-28630.md)
  `CVE-2023-28630` · CVE record: gocd gocd · CVSS 4.2 Medium · Not analysed yet · Published 27 Mar 2023 · Tags: Information disclosure
- [Compromised agents may be able to execute remote code on GoCD Server](https://agentprime.io/advisories/CVE-2022-39311.md)
  `CVE-2022-39311` · CVE record: gocd gocd · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2022 · Tags: Insecure deserialization
- [Malicious agent may be able to impersonate another agent in GoCD](https://agentprime.io/advisories/CVE-2022-39310.md)
  `CVE-2022-39310` · CVE record: gocd gocd · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: Broken access control
- [GoCD server secret encryption/decryption key leaked to agents during material serialization](https://agentprime.io/advisories/CVE-2022-39309.md)
  `CVE-2022-39309` · CVE record: gocd gocd · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: Information disclosure, CWE-499
- [GoCD API authentication of user access tokens subject to timing attack during comparison](https://agentprime.io/advisories/CVE-2022-39308.md)
  `CVE-2022-39308` · CVE record: gocd gocd · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: CWE-208, CWE-1254
- [GoCD Windows installations outside default location inadequately restrict installation file permissions](https://agentprime.io/advisories/CVE-2022-36088.md)
  `CVE-2022-36088` · CVE record: gocd gocd · CVSS 5.0 Medium · Not analysed yet · Published 7 Sept 2022 · Tags: Privilege escalation, Broken access control
- [Command Injection/Argument Injection in GoCD](https://agentprime.io/advisories/CVE-2022-29184.md)
  `CVE-2022-29184` · CVE record: gocd gocd · CVSS 8.8 High · Not analysed yet · Published 20 May 2022 · Tags: Command injection
- [Reflected XSS in GoCD](https://agentprime.io/advisories/CVE-2022-29183.md)
  `CVE-2022-29183` · CVE record: gocd gocd · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2022 · Tags: Cross-site scripting (XSS)
- [DOM-based XSS in GoCD](https://agentprime.io/advisories/CVE-2022-29182.md)
  `CVE-2022-29182` · CVE record: gocd gocd · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2022 · Tags: Cross-site scripting (XSS)
- [Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames](https://agentprime.io/advisories/CVE-2022-24832.md)
  `CVE-2022-24832` · CVE record: gocd gocd · CVSS 8.2 High · Not analysed yet · Published 11 Apr 2022 · Tags: Other injection
- [gocd: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to…](https://agentprime.io/advisories/CVE-2021-25924.md)
  `CVE-2021-25924` · CVE record: gocd · No CVSS score · Not analysed yet · Published 1 Apr 2021

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gocd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gocd/>. Everything for agents: <https://agentprime.io/llms.txt>.