---
id: CVE-2026-61549
title: Woodpecker is a CI/CD engine
summary: >-
  Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0,
  pipeline/backend/kubernetes/backend_options.go defines
  backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in
  pipeline/backend/kubernetes/pod.go copies that pip…
severity: critical
cvss: 9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cwe:
  - CWE-269
  - CWE-862
vendor: woodpecker-ci
product: woodpecker
affected:
  - 'woodpecker >= 1.0.0, < 3.16.0'
patched:
  - go.woodpecker-ci.org/woodpecker/v3 3.16.0
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T04:18:37.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61549'
references:
  - url: >-
      https://github.com/woodpecker-ci/woodpecker/commit/5df9d52260626c074c6caafb2dc83d3bc6b53be1
    label: security-advisories@github.com
  - url: >-
      https://github.com/woodpecker-ci/woodpecker/commit/609ba481b5e912f59aaae8ca7bc22b44523c5e37
    label: security-advisories@github.com
  - url: 'https://github.com/woodpecker-ci/woodpecker/pull/6792'
    label: security-advisories@github.com
  - url: 'https://github.com/woodpecker-ci/woodpecker/releases/tag/v3.16.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-qf34-295c-26v8
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qf34-295c-26v8'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T15:19:32.446538Z'
cvssSource: cna
aliases:
  - GHSA-qf34-295c-26v8
ecosystem: go
ingestedAt: '2026-07-14T20:39:11.070Z'
epss: 0.00166
epssPercentile: 0.06307
---

## Overview

Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61549)

Affected packages:

- `go.woodpecker-ci.org/woodpecker/v3 < 3.16.0`
- `github.com/woodpecker-ci/woodpecker >= 1.0.0, <= 1.0.4`
- `go.woodpecker-ci.org/woodpecker/v2 <= 2.8.3`

Patched in:

- `go.woodpecker-ci.org/woodpecker/v3 3.16.0`

Source: https://github.com/advisories/GHSA-qf34-295c-26v8