Woodpecker CI EUVD-2026-40357

The /api/orgs/lookup/*org_full_name API endpoint must be network-reachable - Woodpecker CI instances exposed to the internet or accessible from untrusted internal networks are at risk. No authentication, no account, no specific Woodpecker configuration, and no user interaction is required; any well-formed HTTP GET to this path triggers the nil dereference. Exploitation is structurally bounded by gin's panic recovery middleware, which prevents full service outage - the server continues processing legitimate requests and returns HTTP 500 on the affected endpoint rather than crashing entirely. The impact ceiling is therefore log flooding, storage cost inflation, and log-signal degradation rather than complete availability loss. Instances with metered log ingestion (e.g., cloud SIEM with per-GB pricing), size-limited disk partitions hosting logs, or heavy reliance on error-log alerting face the highest operational impact. Instances with no internet exposure and generous log storage headroom face limited real-world risk.

The CVSS 4.0 score of 6.9 with VA:L (low availability impact to the vulnerable system) accurately reflects the constrained blast radius: the server remains operational due to gin's recovery middleware, so impact is limited to log flooding, disk exhaustion, elevated log-ingestion costs, and analyst alert fatigue. The attack metrics AV:N/AC:L/AT:N/PR:N/UI:N confirm trivial, unauthenticated, network-reachable exploitation with no complexity barriers, making it fully automatable. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no confirmed public POC at time of analysis, reducing the urgency tier compared to a fully weaponized vulnerability. Real-world priority is moderate: internet-exposed Woodpecker instances with metered or size-capped log storage, or environments relying on log-based alerting, face meaningful operational impact. Instances behind network controls with generous log capacity face lower near-term risk but should still patch promptly given zero-complexity exploitation.

An unauthenticated attacker sends a high-frequency stream of HTTP GET requests to /api/orgs/lookup/<arbitrary_string> on an internet-facing Woodpecker CI server. No exploit code or special tooling is required - a curl loop or any HTTP benchmarking tool suffices. At modest rates (e.g., a few hundred requests per second), the attacker inflates disk usage by hundreds of megabytes per hour in stack trace log output and overwhelms downstream SIEM ingestion pipelines, burying legitimate CI/CD and security log events.