{"id":"CVE-2023-40034","aliases":["GHSA-4gcf-5m39-98mc","GO-2023-2014"],"title":"Woodpecker does not validate webhook before changing any data","summary":"Woodpecker does not validate webhook before changing any data","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"woodpecker-ci","product":"github.com/woodpecker-ci/woodpecker","ecosystem":"go","affected":["github.com/woodpecker-ci/woodpecker >= 1.0.0, < 1.0.2"],"patched":["github.com/woodpecker-ci/woodpecker 1.0.2"],"published":"2023-08-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:57.379318861Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4gcf-5m39-98mc","references":[{"url":"https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40034"},{"url":"https://github.com/woodpecker-ci/woodpecker/pull/2221"},{"url":"https://github.com/woodpecker-ci/woodpecker/pull/2222"},{"url":"https://github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105"},{"url":"https://github.com/woodpecker-ci/woodpecker"},{"url":"https://github.com/woodpecker-ci/woodpecker/releases/tag/v1.0.2"}],"tags":["osv","go"],"epss":0.00883,"epssPercentile":0.57665,"ingestedAt":"2026-09-12T03:13:01.752Z","slug":"CVE-2023-40034","body":"## Overview\n\n### Impact\nAn attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository.\nThis is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage.\n\n### Patches\nPlease use either next or the latest v1.0 e.g. v1.0.2\n\n### Workarounds\nSecure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.\n\n### References\nFix: https://github.com/woodpecker-ci/woodpecker/pull/2221\nBackport: https://github.com/woodpecker-ci/woodpecker/pull/2222\n\n## Affected packages\n\n- `github.com/woodpecker-ci/woodpecker >= 1.0.0, < 1.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/woodpecker-ci/woodpecker 1.0.2`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}