EUVD-2026-40357
GHSA-xq6m-xxrf-h53q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or complexity barriers; availability impact is low because gin recovery prevents service crash; no confidentiality or integrity impact; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user (user.ForgeID, via ForgeFromUser) when selecting the forge to query. For an unauthenticated request session.User returns nil, so any unauthenticated HTTP request triggers a NULL pointer dereference in the handler. The panic is recovered by gin recovery middleware and the server continues serving (returning HTTP 500), but each request writes a multi-line panic stack trace to the error log. A low-bandwidth unauthenticated attacker can repeatedly probe the endpoint to flood the logs (about 37 lines per request), inflating disk usage and downstream log-ingestion cost and burying legitimate log events.
AnalysisAI
Unauthenticated NULL pointer dereference in Woodpecker CI before 3.15.0 allows any network attacker to flood server logs by repeatedly probing the unprotected /api/orgs/lookup/ endpoint. The LookupOrg handler unconditionally dereferences the session user object, which is nil for unauthenticated callers, triggering a Go panic on every such request; gin's recovery middleware catches each panic and returns HTTP 500, keeping the server alive but writing approximately 37 lines of stack trace per request to the error log. No active exploitation is confirmed in CISA KEV, but the zero-prerequisite attack surface - no credentials, no special configuration, no user interaction - makes low-bandwidth log-flooding trivially achievable by any unauthenticated network attacker.
Technical ContextAI
Woodpecker CI is an open-source, community-maintained CI/CD pipeline server written in Go; CPE cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* covers all releases prior to the fixed version 3.15.0. The root cause is CWE-476 (NULL Pointer Dereference): when registering the /api/orgs/lookup/*org_full_name route, the application omits authentication middleware, so session.User() returns nil for unauthenticated callers. The LookupOrg handler then calls user.ForgeID via ForgeFromUser without a nil guard, causing the Go runtime to panic. The gin web framework's built-in recovery middleware intercepts the panic, serializes the full goroutine stack trace to the error log, and returns an HTTP 500 response - preventing a crash but making the log subsystem a denial-of-service vector. The bug is a structural omission at route registration time rather than a logic error inside the handler itself.
RemediationAI
Upgrade Woodpecker CI to version 3.15.0 or later; this is the vendor-released patch confirmed by release tag v3.15.0, pull request #6652, and commit 1fbacac3a43b75b6e5a0a40a4f720a0017c62010 (https://github.com/woodpecker-ci/woodpecker/commit/1fbacac3a43b75b6e5a0a40a4f720a0017c62010), with the full VulnCheck advisory at https://www.vulncheck.com/advisories/woodpecker-unauthenticated-null-pointer-dereference-in-api-orgs-lookup-enables-log-flooding-denial-of-service. If immediate upgrade is not possible, deploy a reverse proxy or WAF rule to block all unauthenticated requests to the /api/orgs/lookup/ path prefix; this eliminates the attack surface without affecting authenticated user workflows, though it requires a proxy layer already in place. As an additional compensating control, configure log rotation with size caps and rate limits on Woodpecker's error output to bound disk consumption during an attack - note this may cause log loss during high-volume probing, which itself impairs incident visibility.
More in Woodpecker
View allApproval-gate bypass in Woodpecker CI before 3.15.0 lets an attacker who can open a merge request from a fork against a
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. Rated high severity (CVSS 8.8), this vulnerab
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. Rated high severity (CVSS 8.8), this vulnerab
Woodpecker is a community fork of the Drone CI system. Rated high severity (CVSS 8.1), this vulnerability is remotely ex
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping. Ra
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today