CVE-2026-58369: Woodpecker Unauthenticated Log Flooding via NULL Pointer Dereference

Technical summary

CVE-2026-58369 is a null pointer dereference vulnerability in Woodpecker's LookupOrg HTTP handler. The /api/orgs/lookup/*org_full_name endpoint lacks authentication middleware, permitting unauthenticated requests to reach handler logic that unconditionally dereferences session.User via ForgeFromUser(user.ForgeID). Since session.User is nil for unauthenticated requests, the dereference triggers a panic. Although gin's recovery middleware catches the panic and returns HTTP 500, each request appends multi-line stack traces to the error log. This design allows an attacker to amplify log volume (~37 lines per request) through low-effort, low-bandwidth requests, degrading observability and inflating downstream log storage costs.

Business impact

This vulnerability enables a log-flooding denial-of-service attack that can obscure legitimate security events, complicate incident investigation, and increase cloud log-ingestion costs. While not directly compromising confidentiality or integrity, the attack reduces visibility into actual threats and operational issues. Organizations relying on logs for compliance auditing, forensics, or real-time alerting face reduced effectiveness. The low barrier to exploitation (unauthenticated, low bandwidth) means even resource-constrained attackers can mount sustained campaigns against affected instances.

Affected systems

Woodpecker versions prior to 3.15.0 are vulnerable. The affected endpoint is /api/orgs/lookup/*org_full_name. The vulnerability requires no authentication, so any network-accessible Woodpecker instance running a vulnerable version is at risk. Deployments with public-facing Woodpecker services or those within untrusted network segments face higher risk.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no special privileges, and no user interaction. An attacker needs only network connectivity to the endpoint and can automate log flooding with simple HTTP requests. CVSS 3.1 assigns this a score of 5.3 (MEDIUM severity) because the impact is limited to availability (log flooding) rather than data confidentiality or integrity. The attack is straightforward to execute and sustain with minimal resources.

Remediation

Upgrade Woodpecker to version 3.15.0 or later, which should address the missing authentication middleware and the unsafe session user dereference. Verify the fix against the vendor advisory before deploying. Interim mitigations include network-level access controls to restrict who can reach the endpoint, rate limiting on /api/orgs/lookup endpoints, and monitoring for repeated 500 errors from the same source. Ensure log retention and alerting are tuned to detect sudden spikes in error log volume.

Patch guidance

Apply the update to Woodpecker 3.15.0 or later as soon as feasible. Before patching, validate the fix in a non-production environment and confirm that legitimate org lookup traffic is not disrupted. Review release notes for any breaking changes or additional configuration steps. If immediate patching is not possible, implement compensating controls such as WAF rules to block repeated requests to the vulnerable endpoint or authentication proxies that enforce login before reaching Woodpecker.

Detection guidance

Monitor for patterns of repeated HTTP 500 responses from the /api/orgs/lookup endpoint originating from a single source IP or a small set of IPs. Flag sudden increases in error log volume from this endpoint, particularly if stack traces mentioning ForgeFromUser or nil pointer dereference appear. Correlate log spikes with network traffic patterns. Use SIEM rules to alert on sustained error rates exceeding normal baselines. Log inspection for panic traces in error output can confirm exploitation.

Why prioritize this

Although CVSS scores this as MEDIUM, the ease of exploitation and the operational impact warrant prompt attention. The vulnerability requires no authentication and imposes minimal attacker overhead, making it attractive for widespread reconnaissance or low-effort disruption. For organizations with public-facing or easily accessible Woodpecker instances, or those with strict log-based alerting and compliance requirements, this should be prioritized ahead of higher-CVSS vulnerabilities that demand more complex exploitation chains. Patching is straightforward and carries low risk, supporting rapid remediation.

Risk score, explained

CVE-2026-58369 is scored CVSS 3.1 v5.3 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The high accessibility (network, no authentication, low complexity) and ease of automation elevate practical risk despite the theoretical score. Confidentiality and integrity are unaffected, but availability degradation through log flooding can harm observability and incident response—indirect but material harms. The score accurately reflects the severity of the direct technical impact; contextualize it with business dependence on logging and audit trails.

Frequently asked questions