CVE-2026-55870

GoCD , a continuous delivery server, prior to version 26.1.0 , can expose unmasked credentials that administrators embedded in the userinfo portion of source control material URLs through several read-only APIs accessible to regular authenticated users. The root cause is that legacy configuration...

CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...