What is CVE-2026-58370?

CVE-2026-58370 is a high-severity vulnerability in Woodpecker-ci Woodpecker, classified under Authentication Bypass by Spoofing. CVSS score: 8.1/10. Published 2026-06-30.

How severe is CVE-2026-58370?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Woodpecker-ci Woodpecker

CVE-2026-58370

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, w…

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Woodpecker-ci Woodpecker — versions 0

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-58370?: CVE-2026-58370 is a high-severity vulnerability in Woodpecker-ci Woodpecker, classified under Authentication Bypass by Spoofing. CVSS score: 8.1/10. Published 2026-06-30.
How severe is CVE-2026-58370?: High severity. CVSS v3 base score is 8.1 out of 10.