CVE-2026-50141: Agent Impersonation via gRPC Metadata Spoofing in Woodpecker CI

Vulnerability ID: CVE-2026-50141
CVSS Score: 7.1
Published: 2026-07-14

A critical authentication bypass vulnerability in Woodpecker CI allows authenticated agents to impersonate other agents by injecting spoofed agent_id values into gRPC metadata. This flaw is caused by the use of md.Append instead of md.Set on the server-side RPC authorizer.

TL;DR

Woodpecker CI server used an unsafe metadata append operation, allowing authenticated agents to spoof their identity and impersonate any other registered agent.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-290, CWE-639
• Attack Vector: Network
• CVSS v4.0 Score: 7.1 (High)
• Exploit Status: PoC (Proof of Concept)
• Affected Component: gRPC Authorization Interceptor (server/rpc/authorizer.go)
• Fixed Version: v3.14.1

Affected Systems

• Woodpecker CI Server
• Woodpecker CI: >= 3.0.0, < 3.14.1 (Fixed in: 3.14.1)

Code Analysis

Commit: da744e8

Fix: overwrite agent_id in rpc metadata with verified token values instead of appending

@@ -140,7 +140,7 @@
        return ctx, status.Errorf(codes.Unauthenticated, "access token is invalid: %v", err)
    }

-   md.Append("agent_id", fmt.Sprintf("%d", claims.AgentID))
+   md.Set("agent_id", fmt.Sprintf("%d", claims.AgentID))

    return metadata.NewIncomingContext(ctx, md), nil

Commit: e6f4770

Refactor: store verified agent identities securely in request context keys rather than mutable gRPC metadata

Mitigation Strategies

• Upgrade to Woodpecker CI server and agent version 3.14.1 or higher.
• Disable user or organization-level agent registration to restrict authorized access to trusted administrators.

Remediation Steps:

1. Set the environment variable WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true on the Woodpecker server.
2. Audit existing agents and remove any unauthorized or user-registered agents from the database.
3. Deploy the updated Woodpecker server container image using version 3.14.1 or later.

References

• GitHub Security Advisory
• Woodpecker Security Issue 21
• Woodpecker Issue 6541
• Pull Request 6567
• Pull Request 6569
• NVD CVE-2026-50141 Detail
• CVE-2026-50141 Record

Read the full report for CVE-2026-50141 on our website for more details including interactive diagrams and full exploit analysis.