CVE-2026-61549 : Detail

CVE-2026-61549

2026-09-15
15h17 +00:00
Improper Privilege ManagementAuthorization problems
A04-Insecure DesignA01-Broken Access Control
2026-09-30
17h51 +00:00
CVE.org
NVD
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.

Informasi CVE

Kelemahan Terkait

CWE-ID Nama Kelemahan Sumber
CWE-269 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Referensi

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.