The vulnerability in GoCD allows an authenticated user to call the internal fetch‑artifact autosuggestion API at /go/api/internal/pipelines//upstream. This endpoint exposes the upstream dependency hierarchy, plugin names, and other metadata that are otherwise hidden from the UI. The API is read‑only, so no configuration or pipeline data can be altered, but the information disclosed can aid an attacker in mapping the pipeline structure and identifying potential attack pathways.

The issue affects GoCD versions 20.2.0 through 26.1.0, inclusive. All installations of the gocd:gocd product that are at or below 26.1.0 are vulnerable unless otherwise mitigated.

With a CVSS score of 5.3, the vulnerability is considered medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and must have access to the internal API, which is typically reachable only within the same network or behind authentication. Because the endpoint reveals only read‑only metadata, exploitation is limited to information gathering rather than immediate control over pipeline execution.