{"id":"CVE-2026-50141","aliases":["GHSA-g7mm-9vx7-jm7h"],"title":"Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation","summary":"Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation","severity":"high","cwe":["CWE-290","CWE-639"],"vendor":"woodpecker","product":"go.woodpecker-ci.org/woodpecker/v3","ecosystem":"go","affected":["go.woodpecker-ci.org/woodpecker/v3 >= 3.0.0, < 3.14.1"],"patched":["go.woodpecker-ci.org/woodpecker/v3 3.14.1"],"published":"2026-07-14","updated":"2026-07-14","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-g7mm-9vx7-jm7h","references":[{"url":"https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50141"},{"url":"https://github.com/woodpecker-ci/woodpecker-security/issues/21"},{"url":"https://github.com/woodpecker-ci/woodpecker/issues/6541"},{"url":"https://github.com/woodpecker-ci/woodpecker/pull/6567"},{"url":"https://github.com/woodpecker-ci/woodpecker/pull/6569"},{"url":"https://github.com/advisories/GHSA-g7mm-9vx7-jm7h"}],"tags":["ghsa","go"],"epss":0.00427,"epssPercentile":0.36617,"ingestedAt":"2026-07-14T19:38:53.218Z","slug":"CVE-2026-50141","body":"## Overview\n\n### Impact\nA vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value.\n\n### Patches\nDirect patch: https://github.com/woodpecker-ci/woodpecker/pull/6567\nLater proper fix: https://github.com/woodpecker-ci/woodpecker/pull/6569\n\n### Workarounds\nDisable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones\n\n### Resources\nPublic ref: https://github.com/woodpecker-ci/woodpecker/issues/6541\nPrivate com: https://github.com/woodpecker-ci/woodpecker-security/issues/21\n\n## Affected packages\n\n- `go.woodpecker-ci.org/woodpecker/v3 >= 3.0.0, < 3.14.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `go.woodpecker-ci.org/woodpecker/v3 3.14.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}