Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
woodpecker-ci/woodpecker
main @ 302f211
118
Fixes
4
CVEs
CRITICAL
Peak severity
38.5%
Coverage
Highlights
Auth Bypass: 52 prior fixes. Scrutinize any change in this area.
server/api/hook.go: most-fixed (6 issues). Treat as high-risk during review.
55 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Attackers could spoof gRPC metadata or bypass agent-to-workflow mapping restrictions to escalate agent privileges or intercept build tasks. Strict validation of agent ID context and workflow mapping is required.
Auth Bypass: Processing malformed or unverified repository webhooks allows unauthorized users to override configurations or trigger workflows, leading to potential repo takeover (CVE-2023-40034).
Privilege Escalation: Workflow containers can bypass isolation constraints if arbitrary steps are mapped as privileged or if they can hijack execution environments using insecure environment variables.