GoCD versions before 26.1.0 can return unmasked credentials that administrators store in the userinfo part of source control material URLs through several read‑only APIs that are available to any authenticated user. A legitimate user with access to a pipeline can obtain plain‑text username and password combinations embedded in the URL, while dedicated password fields remain encrypted and are not exposed. This flaw represents a credential disclosure weakness (CWE‑200/CWE‑522).

GoCD deployments running any release older than 26.1.0 are affected. The product is identified as gocd:gocd. No specific product sub‑versions were listed beyond the date relative to 26.1.0.

The CVSS score is 2.3, indicating a low severity level. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploit requires an authenticated user who can read pipeline information via available read‑only APIs; it does not provide privilege escalation or remote code execution. The attack vector is through standard REST or UI endpoints that expose material URLs, making the risk moderate but warranting timely remediation.