GoCD EUVD-2026-83954

Requires an authenticated account holding the pipeline group administrator role on the GoCD server (PR:H); normal authenticated users are explicitly not affected. The attacker reaches the legacy /go/admin/restful/* routes over the network with low complexity and no user interaction, and the endpoint is read-only (does not modify server configuration). Exploitation is neutralized in deployments that restrict pipeline editing to full administrators or to configuration repositories - those configurations are not affected. The rogue-agent follow-on (receiving work or overwriting other groups' artifacts) is described as a higher-complexity path requiring use of the disclosed agent auto-registration key.

This is a moderate-severity broken-authorization issue (CWE-863), not a critical priority. The vendor CVSS 4.0 vector (5.1) is telling: AV:N/AC:L give it network reach and low complexity, but PR:H is the dominant limiter - exploitation requires an already-trusted pipeline group administrator account, and impact is scoped low (VC:L confidentiality, VI:N, VA:N, with only a secondary SI:L reflecting the rogue-agent artifact-overwrite path). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation - the realistic threat is insider/lateral abuse by a semi-privileged tenant rather than mass remote attack. One data conflict to flag: the CVSS vector is CVSS 4.0 only (no 3.1 vector provided), and the input Tags label this 'Authentication Bypass' when the description and CWE-863 make it an authorization/access-control (over-broad disclosure) issue, not an auth bypass. Bottom line: prioritize for multi-tenant GoCD deployments where pipeline group admins are not fully trusted, but it is not a drop-everything emergency.

A malicious or compromised pipeline group administrator on a multi-tenant GoCD server sends an authenticated request to a legacy /go/admin/restful/* route and receives the full historical server configuration - including agent auto-registration keys, webhook invocation keys, encrypted material credentials, and the GoCD administrator list - rather than only their own groups' config. Using the disclosed agent registration key, the attacker can then connect a rogue compatible agent to pursue a higher-complexity path toward receiving other groups' work or overwriting their artifacts. No public exploit code was identified at time of analysis.