What is GHSA-g7mm-9vx7-jm7h?

GHSA-g7mm-9vx7-jm7h is a security advisory published by GitHub Security Advisories with High severity. Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

Which CVE IDs does GHSA-g7mm-9vx7-jm7h cover?

GHSA-g7mm-9vx7-jm7h covers the following CVE IDs: CVE-2026-50141. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-g7mm-9vx7-jm7h?

GHSA-g7mm-9vx7-jm7h affects 1 product, including: go/go.woodpecker-ci.org/woodpecker/v3:\u003e= 3.0.0, \u003c 3.14.1.

GHSA-g7mm-9vx7-jm7hHigh

Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

Vendor

GitHub Security Advisories

Published

July 14, 2026

Last Modified

July 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-50141 →

📋 Description

Impact

A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agent_id value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value.

Patches

Direct patch: https://github.com/woodpecker-ci/woodpecker/pull/6567 Later proper fix: https://github.com/woodpecker-ci/woodpecker/pull/6569

Workarounds

Disable org agents (WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true) and delete existing ones

Resources

Public ref: https://github.com/woodpecker-ci/woodpecker/issues/6541 Private com: https://github.com/woodpecker-ci/woodpecker-security/issues/21

🎯 Affected products1

go/go.woodpecker-ci.org/woodpecker/v3:>= 3.0.0, < 3.14.1