Home › CVE Intelligence › CVE-2026-50141
CVSS 7.5 HIGH Vulnerability

CVE-2026-50141: Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agent_id value into outgoing gRPC metadata. The server correct…

7.5CVSS Score
HIGHSeverity
NOCISA KEV
VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-50141
Vendorgo
Affected Productgo.woodpecker-ci.org/woodpecker/v3
Vulnerability TypeVulnerability
CVSS Score7.5 (HIGH)
Actively Exploited❌ No known exploitation
Patch StatusSee Vendor Advisory →
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories)

🔬 Technical Analysis

#

Impact

A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agent_id value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value.

Patches

Direct patch: https://github.com/woodpecker-ci/woodpecker/pull/6567 Later proper fix: https://github.com/woodpecker-ci/woodpecker/pull/6569

Workarounds

Disable org agents (WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true) and delete existing ones

Resources

Public ref: https://github.com/woodpecker-ci/woodpecker/issues/6541 Private com: https://github.com/woodpecker-ci/woodpecker-security/issues/21

🎯 Known Indicators of Compromise

{"type":"url","value":"https://github.com/woodpecker-ci/woodpecker/pull/6567","confidence_score":0.82,"first_seen":"2026-07-14","source_count":1} {"type":"url","value":"https://github.com/woodpecker-ci/woodpecker/pull/6569","confidence_score":0.82,"first_seen":"2026-07-14","source_count":1} {"type":"url","value":"https://github.com/woodpecker-ci/woodpecker/issues/6541","confidence_score":0.82,"first_seen":"2026-07-14","source_count":1} {"type":"url","value":"https://github.com/woodpecker-ci/woodpecker-security/issues/21","confidence_score":0.82,"first_seen":"2026-07-14","source_count":1}

📚 Advisory References

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-50141 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence