CVE-2026-61549

Woodpecker CI, a self-hosted open-source CI/CD engine, does not enforce administrator authorization on the backend_options.kubernetes.serviceAccountName pipeline option: the Kubernetes backend copies this user-supplied value directly from the pipeline step into the pod specification. Any user with Push permission on a repository connected to the Woodpecker server can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. If a privileged ServiceAccount is reachable, an attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. All versions from 1.0.0 until 3.16.0 that use the Kubernetes backend are affected; the flaw is fixed in 3.16.0. No public proof of concept is known, the issue is not in the CISA KEV catalog, and there is no evidence of in-the-wild exploitation.

What to do: Upgrade to Woodpecker CI 3.16.0 or later, where ServiceAccount selection requires administrator authorization. Until patched, audit RBAC in pipeline namespaces and remove or restrict any privileged ServiceAccounts reachable from them. Review pipeline histories for unexpected use of backend_options.kubernetes.serviceAccountName and rotate database credentials, API keys, and TLS certificates accessible to those accounts if misuse is found.