---
id: CVE-2026-50141
aliases:
  - GHSA-g7mm-9vx7-jm7h
title: >-
  Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent
  impersonation
summary: >-
  Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent
  impersonation
severity: high
cwe:
  - CWE-290
  - CWE-639
vendor: woodpecker
product: go.woodpecker-ci.org/woodpecker/v3
ecosystem: go
affected:
  - 'go.woodpecker-ci.org/woodpecker/v3 >= 3.0.0, < 3.14.1'
patched:
  - go.woodpecker-ci.org/woodpecker/v3 3.14.1
published: '2026-07-14'
updated: '2026-07-14'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-g7mm-9vx7-jm7h'
references:
  - url: >-
      https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-g7mm-9vx7-jm7h
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50141'
  - url: 'https://github.com/woodpecker-ci/woodpecker-security/issues/21'
  - url: 'https://github.com/woodpecker-ci/woodpecker/issues/6541'
  - url: 'https://github.com/woodpecker-ci/woodpecker/pull/6567'
  - url: 'https://github.com/woodpecker-ci/woodpecker/pull/6569'
  - url: 'https://github.com/advisories/GHSA-g7mm-9vx7-jm7h'
tags:
  - ghsa
  - go
epss: 0.00427
epssPercentile: 0.36629
ingestedAt: '2026-07-14T19:38:53.218Z'
---

## Overview

### Impact
A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value.

### Patches
Direct patch: https://github.com/woodpecker-ci/woodpecker/pull/6567
Later proper fix: https://github.com/woodpecker-ci/woodpecker/pull/6569

### Workarounds
Disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones

### Resources
Public ref: https://github.com/woodpecker-ci/woodpecker/issues/6541
Private com: https://github.com/woodpecker-ci/woodpecker-security/issues/21

## Affected packages

- `go.woodpecker-ci.org/woodpecker/v3 >= 3.0.0, < 3.14.1`

## Remediation

Upgrade to a patched release:

- `go.woodpecker-ci.org/woodpecker/v3 3.14.1`