GO-2026-5992 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the serviceAccountName field in the Kubernetes backend configuration. An attacker can gain elevated privileges by specifying an arbitrary ServiceAccount, allowing access to sensitive resources and potential ful...

GHSA-QF34-295C-26V8 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

Impact A privilege escalation vulnerability affects Woodpecker instances using the Kubernetes backend. The pipeline option backendoptions.kubernetes.serviceAccountName was passed directly to the pod spec without any admin gating. Who is impacted: any operator running the Kubernetes backend. Any...

PT-2026-60111

Name of the Vulnerable Software and Affected Versions Woodpecker CI versions v1.0.0 through v3.15.0 Description A privilege escalation issue exists in instances using the Kubernetes backend. The pipeline option backend options.kubernetes.serviceAccountName is passed directly to the pod spec witho...

Malicious code in backstage-plugin-kubernetes-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d5e128ce958505a3df2acbdc6b87aaf80b05e6b5a1dec494681ab2ceced6a0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...