Threats affecting pkg:github/woodpecker-ci/woodpecker

Woodpecker CI/CD engine versions from 1.0.0 up to but not including 3.16.0 contain an improper privilege management vulnerability. The Kubernetes backend allows users with Push permission on a repository to specify an arbitrary ServiceAccount for pipeline pods without administrator authorization. This can lead to privilege escalation where an attacker may access sensitive secrets and potentially take over the Kubernetes cluster. The issue is fixed in version 3.16.0.

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in favor of the client-supplied value. Version 3.14.1 patches the issue. As a workaround, disable org agents (`WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=true`) and delete existing ones.