Woodpecker CI CVE-2026-58370

Requires the target Woodpecker server to use the GitLab forge driver AND to have the fork-approval allowlist (ApprovalAllowedUsers) populated with at least one trusted entry; the attacker must be able to open a merge request from a fork (possible to anyone on public/open GitLab projects) and must know or guess one allowlisted author name to place in the spoofed commit.author.name. Limiting factors that reduce real-world exposure: instances on Gitea, Forgejo, GitHub, or Bitbucket are not vulnerable at all; instances that do not use ApprovalAllowedUsers have nothing to bypass; and exploitation value depends on secrets actually being exposed to fork-triggered runs. No additional authentication on Woodpecker itself is needed (PR:N), and no user interaction by a victim is required.

Signals are mixed but lean toward a genuine, high-impact issue for the affected deployment subset. The CVSS 4.0 base score is 9.2 (Critical) with AV:N/AC:H/AT:P/PR:N/UI:N and full VC:H/VI:H/VA:H, reflecting remote, unauthenticated abuse leading to code execution and secret disclosure; AC:H and AT:P acknowledge that exploitation depends on a specific configuration (GitLab forge plus a populated ApprovalAllowedUsers list) and on the attacker meeting a presence requirement (ability to open a fork MR). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no evidence of active or widespread exploitation - the elevated score is driven by impact and ease of spoofing, not by observed attacks. The practical risk is concentrated: organizations running Woodpecker against GitLab with fork approvals enabled face a real and easily triggered bypass, while GitHub/Gitea/Forgejo/Bitbucket users are not exposed at all. Treat as a priority patch for GitLab-backed instances; lower urgency elsewhere.

An attacker forks a public GitLab project that is built by a Woodpecker instance using fork approvals, then crafts a commit whose author name (commit.author.name) matches a trusted entry in ApprovalAllowedUsers and opens a merge request. Woodpecker's needsApproval check returns false, so the attacker's pipeline runs automatically on an agent, executing arbitrary steps and reading any CI secrets exposed to the job. No public PoC is published, but the spoof requires only standard git tooling and knowledge of one allowlisted name.