GoCD’s internal material connection test APIs (/go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test) accept an arbitrary pipeline or pipeline group context without sufficient validation. This flaw allows a pipeline group administrator to invoke a test connection for source control materials outside the administrator’s authorized group, potentially using credentials stored in those materials. The lack of proper authorization checks can expose source control credentials and, for GoCD 20.6.0 and later, external secrets managed by secret‑management plugins. The impact is the accidental or intentional disclosure of sensitive authentication information.

All GoCD server installations from version 16.1.0 through 26.0.x are impacted. Version 26.1.0 and later contain the fix. The issue affects the standard GoCD continuous delivery server product and any configuration that enables the internal material_test APIs.

The CVSS score of 4.9 categorizes this vulnerability as medium severity. An EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating no currently known exploits and a likely low to moderate exploitation probability. The attack vector is inferred to be internal, requiring an account with pipeline group administration rights to call the API. Once breached, the attacker could obtain source control credentials and any external secrets resolved by secret‑management plugins, compromising confidentiality within the affected GoCD instance. The realistic risk is moderate but remediation is recommended to prevent credential leakage.