Is there a patch available for CVE-2026-55870?

Yes, a patch is available for CVE-2026-55870. Update the affected software to the latest version immediately.

GoCD CVE-2026-55870

Q: What is the CVSS score of CVE-2026-55870?

CVE-2026-55870 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-83953 LOW

Information Exposure (CWE-200)

2026-09-21 GitHub_M

Information Disclosure Gocd

2.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 21, 2026 - 16:16 EUVD

Analysis Generated

Sep 21, 2026 - 15:37 vuln.today

DescriptionCVE.org

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.

AnalysisAI

Authenticated, low-privileged users of GoCD before 26.1.0 can retrieve source-control credentials in cleartext from several read-only pipeline and material APIs whose responses fail to mask the userinfo portion of material URLs. Exposure is narrow: it only affects legacy configurations where an administrator embedded a username and password directly in a material URL, while credentials held in GoCD's dedicated password fields or secret-management plugins stay encrypted and are not disclosed by this issue. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment

This is a genuinely low-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.

Remediation

Vendor-released patch: upgrade to GoCD 26.1.0 or later, available from https://github.com/gocd/gocd/releases/tag/26.1.0 (release notes at https://www.gocd.org/releases/#26-1-0); organizations building GoCD from source can apply upstream commit 19c415d918bb50cb5a3ab7c28e01f4dd51ecb6a5, which makes the affected material representers emit getUriForDisplay() instead of getUrl(). … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.