woodpecker
v3.20.1Woodpecker is a simple, yet powerful CI/CD engine with great extensibility.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 11 advisories8 high, 3 medium · Scorecard 6.1/10
- Supported versions
- No scheduleendoflife.date does not track this project
8.2k stars · 747 forks · 370 open issues · last release 16 days ago · data checked 6 hours ago
Security advisories
All advisories on GitHubThe 11 most recent advisories published by the maintainers: 8 high, 3 medium. Check the patched version against the one you run.
- highGHSA-6frq-4g8m-8xw9Nov 9, 2026Default clone step was not treated as a plugin, so pipeline config could reach it while it held the repo owner's forge credentials
- Affected
- < 3.19.0
- Patched in
- 3.19.0
- mediumGHSA-7852-27mj-v5c9Nov 8, 2026Login page renders error_uri as a link without scheme check (reflected XSS)
- Affected
- < 3.20.0
- Patched in
- 3.20.0
- mediumGHSA-fhhx-3cvv-6473Nov 8, 2026Agent gRPC Next request without label filter crashes the server
- Affected
- >= 3.0.0, < 3.20.0
- Patched in
- 3.20.0
- mediumGHSA-gjxg-ff5f-mq9fNov 8, 2026GitLab: tag pipelines take their author from the git commit, so approval can be skipped (incomplete fix of CVE-2026-58370)
- Affected
- >= 3.14.0, < 3.20.0
- Patched in
- 3.20.0
- highGHSA-v6jr-fc8m-whr3Nov 8, 2026Kubernetes backend: runtimeClassName can be set from pipeline steps without admin gate (incomplete fix of CVE-2026-61549)
- Affected
- < 3.18.0
- Patched in
- 3.18.0
- highGHSA-xwpq-2mq8-p55xNov 8, 2026Matrix variables and manual pipeline variables reach plugin steps as environment (incomplete fix of CVE-2024-41122)
- Affected
- < 3.18.0
- Patched in
- 3.18.0
- highCVE-2026-61549Jul 1, 2026Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
- Affected
- >= 1.0.0, < 3.15.0
- Patched in
- 3.16.0
- highCVE-2026-50141Jun 3, 2026gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
- Affected
- >= 3.0.0, < 3.14.1
- Patched in
- 3.14.1
- highCVE-2024-41121Jul 18, 2024Custom workspace allow to overwrite plugin entrypoint executable
- Affected
- < 2.7.0
- Patched in
- 2.7.0
- highCVE-2024-41122Jul 18, 2024Custom environment variables allow to alter execution flow of plugins witch lead to potential takeover of the plugin
- Affected
- < 2.7.0
- Patched in
- 2.7.0
- highCVE-2023-40034Aug 16, 2023Validate webhook before change any data
- Affected
- >= 1.0.0; < 1.0.2
- Patched in
- 1.0.2