---
id: CVE-2024-41122
aliases:
  - GHSA-3wf2-2pq4-4rvc
  - GO-2024-2998
title: >-
  Woodpecker's custom environment variables allow to alter execution flow of
  plugins
summary: >-
  Woodpecker's custom environment variables allow to alter execution flow of
  plugins
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: woodpecker
product: go.woodpecker-ci.org/woodpecker/v2
ecosystem: go
affected:
  - go.woodpecker-ci.org/woodpecker/v2 < 2.7.0
  - go.woodpecker-ci.org/woodpecker < 2.7.0
patched:
  - go.woodpecker-ci.org/woodpecker/v2 2.7.0
  - go.woodpecker-ci.org/woodpecker 2.7.0
published: '2024-07-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:16.190174600Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3wf2-2pq4-4rvc'
references:
  - url: >-
      https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-41122'
  - url: 'https://github.com/woodpecker-ci/woodpecker-security/issues/10'
  - url: 'https://github.com/woodpecker-ci/woodpecker/issues/3929'
  - url: 'https://github.com/woodpecker-ci/woodpecker/pull/3909'
  - url: 'https://github.com/woodpecker-ci/woodpecker/pull/3934'
  - url: >-
      https://github.com/woodpecker-ci/woodpecker/commit/8aa3e5ec82c92eca3279e4be68625111eeedf1c4
  - url: 'https://github.com/woodpecker-ci/woodpecker'
  - url: 'https://pkg.go.dev/vuln/GO-2024-2998'
tags:
  - osv
  - go
epss: 0.00618
epssPercentile: 0.47412
ingestedAt: '2026-09-12T03:13:01.750Z'
---

## Overview

### Impact
The server allow to create any user who can trigger a pipeline run malicious workflows:
- Those workflows can either lead to a host takeover that runs the agent executing the workflow.
- Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.

### Patches
https://github.com/woodpecker-ci/woodpecker/pull/3909
https://github.com/woodpecker-ci/woodpecker/pull/3934

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
**Enable the "gated" repo feature and review each change upfront of running**

### References
- https://github.com/woodpecker-ci/woodpecker/pull/3909
- https://github.com/woodpecker-ci/woodpecker/pull/3934
- https://github.com/woodpecker-ci/woodpecker-security/issues/10 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3929)
- https://github.com/woodpecker-ci/woodpecker/issues/3929 (info will be published later once we got adoption of the update)

### Credits

- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG)
- Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)

## Affected packages

- `go.woodpecker-ci.org/woodpecker/v2 < 2.7.0`
- `go.woodpecker-ci.org/woodpecker < 2.7.0`

## Remediation

Upgrade to a patched release:

- `go.woodpecker-ci.org/woodpecker/v2 2.7.0`
- `go.woodpecker-ci.org/woodpecker 2.7.0`