CVE-2026-52743 gocd CVE debrief

Who should care

Defenders managing or viewing job statuses in GoCD, especially those with access to the GoCD UI, should assess the impact of unauthorized job status retrieval on pipeline management and security.

Why it matters

CVE-2026-52743 allows authenticated users to retrieve job statuses for unauthorized pipelines in GoCD, potentially leading to sensitive information exposure and impacting pipeline management and security.

• Potential unauthorized retrieval of job statuses for pipelines
• Increased risk of sensitive information exposure through job status data
• Need for verification of exposure for users with access to the GoCD UI
• Potential impact on pipeline management and security due to unauthorized access

Technical summary

The internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request, allowing authenticated users to guess job IDs and retrieve status for jobs in pipelines they cannot otherwise view. This issue allows unauthorized retrieval of job statuses, potentially leading to sensitive information exposure and impacting pipeline management and security. The response does not expose console output, artifacts, commands, variables, or configuration.

Defensive priority

Defenders should prioritize verifying exposure for users with access to the GoCD UI, especially those who manage or view job statuses, and assess the impact of unauthorized job status retrieval.

Recommended defensive actions

• Verify exposure for users with access to the GoCD UI, especially those who manage or view job statuses
• Assess the impact of unauthorized job status retrieval on pipeline management and security
• Update GoCD to version 26.1.0 or later to fix the vulnerability
• Monitor job status retrieval logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in GoCD's internal UI /jobStatus.json API, which allows authenticated users to guess job IDs and retrieve status for jobs in pipelines they cannot otherwise view.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.