CVE-2026-58370

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name commit.author.name carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A us...

Insufficient Verification Of Data Authenticity

go-git is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to improper handling of malformed or ambiguous Git object headers and reconstructing commit data for signing and verification instead of using the original raw object bytes, which allows an attacker t...