GHSA-Q9J8-24P8-JQ8J vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-9694 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-8589 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-HM74-P2XF-RQGC vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-C4M8-PV9J-V7MM vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-9204 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-6277 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-7MQ5-3VCF-V96V vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-5CR4-QWVX-32J2 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-CX4G-HR74-M89M vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-7250 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-6552 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-6976 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the pipeline.Author process. An attacker can execute unauthorized pipeline steps and exfiltrate CI secrets by setting the commit author name in a GitLab webhook payload to match an entry in the approval list,...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the pipeline.Author process. An attacker can execute unauthorized pipeline steps and exfiltrate CI secrets by setting the commit author name in a GitLab webhook payload to match an entry in the approval list,...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the pipeline.Author process. An attacker can execute unauthorized pipeline steps and exfiltrate CI secrets by setting the commit author name in a GitLab webhook payload to match an entry in the approval list,...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the pipeline.Author process. An attacker can execute unauthorized pipeline steps and exfiltrate CI secrets by setting the commit author name in a GitLab webhook payload to match an entry in the approval list,...

CVE-2026-58370 Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name commit.author.name carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A us...

CVE-2026-58370

Woodpecker

CVE-2026-58370 Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name commit.author.name carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A us...