HIGH7.5Go
GHSA-3wf2-2pq4-4rvc· CVE-2024-41122, GO-2024-2998Woodpecker's custom environment variables allow to alter execution flow of plugins
Modified: 9/10/2026
package
Go/go.woodpecker-ci.org/woodpecker/v2
pkg:go/go.woodpecker-ci.org/woodpecker/v2
HIGHGo
GHSA-qf34-295c-26v8· CVE-2026-61549, GO-2026-5992Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Modified: 7/21/2026
HIGH8.8Go
GHSA-xw35-rrcp-g7xm· CVE-2024-41121, GO-2024-2999Woodpecker's custom workspace allow to overwrite plugin entrypoint executable
Modified: 9/10/2026
—Go
GO-2024-2998· CVE-2024-41122, GHSA-3wf2-2pq4-4rvcWoodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker
Modified: 3/3/2026
—Go
GO-2024-2999· CVE-2024-41121, GHSA-xw35-rrcp-g7xmWoodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker
Modified: 3/3/2026
—Go
GO-2026-5976· CVE-2026-50141, GHSA-g7mm-9vx7-jm7hWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation in go.woodpecker-ci.org/woodpecker
Modified: 7/21/2026
—Go
GO-2026-5992· CVE-2026-61549, GHSA-qf34-295c-26v8Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker
Modified: 7/21/2026