[{"uuid":"GSA_kwCzR0hTQS04dzI3LWM0dmMtODhxOc4ABZ_F","url":"https://github.com/advisories/GHSA-8w27-c4vc-88q9","title":"Concourse login flow has an open redirect issue","description":"### Impact\n\nAn attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials.\n\n### Patches\n\nThis has been fixed in 8.2.3\n\n### Workarounds\n\nNone.\n\n### Exploit\n\nVulnerable code was in: https://github.com/concourse/concourse/blob/ea7b812e3a88fdd070f0faece874e8a2d4fbb31c/skymarshal/skyserver/skyserver.go#L162-L170\n\nThe issue stems from the underlying processing logic of Go's `url` package. Normally, `ParseRequestURI()` will eventually reach an internal `url.setPath()` function, where the URL will be decoded. However, if `RawPath` is not empty and `validEncoded(RawPath)` is true, and the decoded result equals `Path`, then return `RawPath` as is; otherwise, escape `Path` again, i.e., decode it again.\n\nIn other words, if the URL contains dangerous characters that should be escaped, such as backslashes (`\\`), then an extra decoding step will be performed. Therefore, `/%2Fexample.com` will be parsed as `//example.com`.\n\nOn vulnerable versions of Concourse, add `/sky/login?redirect_uri=/%252Fexample.com/\\` to your Concourse external URL, login as usual, and you should be redirected to `example.com` instead of your Concourse web server. The redirect happens after the login flow completes. No credentials are leaked.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-07-01T19:01:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/concourse/concourse/security/advisories/GHSA-8w27-c4vc-88q9","https://github.com/concourse/concourse/commit/ac60be5f0435b6592f5a4fcc089050d72ad2452c","https://github.com/concourse/concourse/releases/tag/v8.2.3","https://github.com/advisories/GHSA-8w27-c4vc-88q9"],"source_kind":"github","identifiers":["GHSA-8w27-c4vc-88q9","CVE-2026-49826"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-01T20:00:09.878Z","updated_at":"2026-10-22T15:02:41.643Z","epss_percentage":0.00526,"epss_percentile":0.43701,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04dzI3LWM0dmMtODhxOc4ABZ_F","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04dzI3LWM0dmMtODhxOc4ABZ_F","packages":[{"ecosystem":"go","package_name":"github.com/concourse/concourse","versions":[{"first_patched_version":"1.6.1-0.20260526150512-ac60be5f0435","vulnerable_version_range":"\u003c 1.6.1-0.20260526150512-ac60be5f0435"}],"purl":"pkg:go/github.com%2Fconcourse%2Fconcourse"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04dzI3LWM0dmMtODhxOc4ABZ_F/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01anAyLXZ3cmotOTlyZs4AAvd3","url":"https://github.com/advisories/GHSA-5jp2-vwrj-99rf","title":"Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution ","description":"### Impact\nFor some Post/Put Concourse endpoint containing `:team_name` in the URL, a Concourse user can send a request with body including `:team_name=team2` to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.\n\nExploitable endpoints:\n```\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/builds/:build_name\", Method: \"POST\", Name: RerunJobBuild},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/pause\", Method: \"PUT\", Name: PauseJob},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/unpause\", Method: \"PUT\", Name: UnpauseJob},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/schedule\", Method: \"PUT\", Name: ScheduleJob},\n\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/pause\", Method: \"PUT\", Name: PausePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/unpause\", Method: \"PUT\", Name: UnpausePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/expose\", Method: \"PUT\", Name: ExposePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/hide\", Method: \"PUT\", Name: HidePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/rename\", Method: \"PUT\", Name: RenamePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/archive\", Method: \"PUT\", Name: ArchivePipeline},\n\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/enable\", Method: \"PUT\", Name: EnableResourceVersion},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/disable\", Method: \"PUT\", Name: DisableResourceVersion},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/pin\", Method: \"PUT\", Name: PinResourceVersion},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/unpin\", Method: \"PUT\", Name: UnpinResource},\n\t\n{Path: \"/api/v1/teams/:team_name/artifacts\", Method: \"POST\", Name: CreateArtifact},\n```\n\n### Steps to reproduce\n\n1. Set up a Concourse deployment with team 1 (with pipeline 1) and team 2. User is in team 2 but not team 1.\n2. Login as user to team 2.\n```\nfly -t ci login -n team2 -u user -p password\n```\n3. Try pausing pipeline 1 in team 1 using fly. Verify the command output is `pipeline 'pipeline1' not found`.\n```\nfly -t ci pause-pipeline -p pipeline1\n```\n\n\n4. Send a customized request through `fly curl` command intend to pause pipeline 1 again. \n```\nfly -t ci curl /api/v1/teams/team1/pipelines/pipeline1/pause -- -X PUT -d \":team_name=team2\" -H \"Content-type: application/x-www-form-urlencoded\"\n```\n5. pipeline 1 in team 1 will be paused.\n\nIn step 4, the parameter pollution would allow an user from any team to pause a pipeline that belongs to other team.\n\n### Patches\nConcourse [v6.7.9](https://github.com/concourse/concourse/releases/tag/v6.7.9) and [v7.8.3](https://github.com/concourse/concourse/releases/tag/v7.8.3) were both released with a fix on October 12, 2022.\n\nInstead of using [`FormValue`](https://pkg.go.dev/net/http#Request.FormValue) to parse team_name in the request, where allows body parameters to take precedence over URL query string values, both patch versions are now using `URL.Query().Get()` over multiple scope handlers to prevent the parameter pollution.\n\n### Workarounds\nNo known workarounds for existing versions.\n\n### References\n * https://github.com/concourse/concourse/pull/8566: PR with the fix\n\n### For more information\nIf you have any questions or comments about this advisory, you may reach us privately at [security@concourse-ci.org](mailto:security@concourse-ci.org).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-10-19T20:26:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf","https://github.com/concourse/concourse/pull/8566","https://github.com/concourse/concourse/pull/8580","https://github.com/concourse/concourse/releases/tag/v6.7.9","https://github.com/concourse/concourse/releases/tag/v7.8.3","https://nvd.nist.gov/vuln/detail/CVE-2022-31683","https://github.com/concourse/concourse/commit/57e06711b0d861775a5a6bd078a34abeb0e2638e","https://github.com/concourse/concourse/commit/ba885834d9bcbb9d1ccb9964faa7af0e78a72205","https://github.com/advisories/GHSA-5jp2-vwrj-99rf"],"source_kind":"github","identifiers":["GHSA-5jp2-vwrj-99rf","CVE-2022-31683"],"repository_url":"https://github.com/concourse/concourse","blast_radius":0.0,"created_at":"2022-12-21T16:11:55.231Z","updated_at":"2026-10-27T16:15:59.417Z","epss_percentage":0.00467,"epss_percentile":0.39504,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01anAyLXZ3cmotOTlyZs4AAvd3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01anAyLXZ3cmotOTlyZs4AAvd3","packages":[{"ecosystem":"go","package_name":"github.com/concourse/concourse","versions":[{"first_patched_version":"7.8.3","vulnerable_version_range":"\u003e= 7.0.0, \u003c 7.8.3"},{"first_patched_version":"6.7.9","vulnerable_version_range":"\u003c 6.7.9"}],"purl":"pkg:go/github.com%2Fconcourse%2Fconcourse","statistics":{"dependent_packages_count":21,"dependent_repos_count":22,"downloads":null,"downloads_period":null},"affected_versions":["v0.1.0","v0.1.0-rc.1","v0.1.0-rc.2","v0.1.0-rc.3","v0.1.0-rc.4","v0.1.0-rc.5","v0.1.0-rc.6","v0.1.0-rc.7","v0.2.0","v0.2.0-rc.1","v0.2.0-rc.2","v0.2.0-rc.3","v0.3.0","v0.3.0-rc.1","v0.3.0-rc.2","v0.3.0-rc.3","v0.3.0-rc.4","v0.3.0-rc.5","v0.3.0-rc.6","v0.3.0-rc.7","v0.3.0-rc.8","v0.3.0-rc.9","v0.3.0-rc.10","v0.3.0-rc.11","v0.3.0-rc.12","v0.3.0-rc.13","v0.3.0-rc.14","v0.3.0-rc.15","v0.3.0-rc.16","v0.3.0-rc.17","v0.3.0-rc.18","v0.3.0-rc.19","v0.3.0-rc.20","v0.3.0-rc.21","v0.3.0-rc.22","v0.3.0-rc.23","v0.3.0-rc.24","v0.3.0-rc.25","v0.3.0-rc.26","v0.3.0-rc.27","v0.3.0-rc.28","v0.3.0-rc.29","v0.3.0-rc.30","v0.3.0-rc.31","v0.3.0-rc.32","v0.3.0-rc.33","v0.4.0","v0.4.0-rc.1","v0.5.0","v0.5.0-rc.1","v0.5.0-rc.2","v0.5.0-rc.3","v0.5.0-rc.4","v0.5.0-rc.5","v0.5.0-rc.6","v0.5.0-rc.7","v0.5.0-rc.8","v0.5.0-rc.9","v0.5.0-rc.10","v0.5.0-rc.11","v0.5.0-rc.12","v0.5.0-rc.13","v0.5.0-rc.14","v0.5.0-rc.15","v0.5.0-rc.16","v0.5.0-rc.17","v0.5.0-rc.18","v0.5.0-rc.19","v0.5.0-rc.20","v0.6.0","v0.6.0-rc.1","v0.6.0-rc.2","v0.6.0-rc.3","v0.6.0-rc.4","v0.6.0-rc.5","v0.6.0-rc.6","v0.6.0-rc.7","v0.6.0-rc.8","v0.6.0-rc.9","v0.6.0-rc.10","v0.6.0-rc.11","v0.6.0-rc.12","v0.6.0-rc.13","v0.6.0-rc.14","v0.6.0-rc.15","v0.6.0-rc.16","v0.6.0-rc.17","v0.6.0-rc.18","v0.6.0-rc.19","v0.6.0-rc.20","v0.6.0-rc.21","v0.6.0-rc.22","v0.6.0-rc.23","v0.6.0-rc.24","v0.6.0-rc.25","v0.6.0-rc.26","v0.6.0-rc.27","v0.6.0-rc.28","v0.6.0-rc.29","v0.6.0-rc.30","v0.6.0-rc.31","v0.6.0-rc.32","v0.6.0-rc.33","v0.6.0-rc.34","v0.6.0-rc.35","v0.6.0-rc.36","v0.6.0-rc.37","v0.6.0-rc.38","v0.6.0-rc.39","v0.6.0-rc.40","v0.6.0-rc.41","v0.6.0-rc.42","v0.7.0","v0.7.0-rc.1","v0.7.0-rc.2","v0.7.0-rc.3","v0.7.0-rc.4","v0.7.0-rc.5","v0.7.0-rc.6","v0.7.0-rc.7","v0.7.0-rc.8","v0.7.0-rc.9","v0.7.0-rc.10","v0.7.0-rc.11","v0.7.0-rc.12","v0.7.0-rc.13","v0.7.0-rc.14","v0.7.0-rc.15","v0.7.0-rc.16","v0.7.0-rc.17","v0.7.0-rc.18","v0.7.0-rc.19","v0.7.0-rc.20","v0.7.0-rc.21","v0.7.0-rc.22","v0.7.0-rc.23","v0.7.0-rc.24","v0.7.0-rc.25","v0.7.0-rc.26","v0.7.0-rc.27","v0.7.0-rc.28","v0.7.0-rc.29","v0.7.0-rc.30","v0.7.0-rc.31","v0.7.0-rc.32","v0.7.0-rc.33","v0.7.0-rc.34","v0.7.0-rc.35","v0.7.0-rc.36","v0.7.0-rc.37","v0.8.0","v0.8.0-rc.1","v0.9.0","v0.10.0","v0.11.0","v0.12.0","v0.13.0","v0.14.0","v0.15.0","v0.16.0","v0.17.0","v0.18.0","v0.19.0","v0.20.0","v0.21.0","v0.22.0","v0.23.0","v0.24.0","v0.25.0","v0.26.0","v0.27.0","v0.28.0","v0.29.0","v0.30.0","v0.31.0","v0.32.0","v0.33.0","v0.34.0","v0.35.0","v0.36.0","v0.37.0","v0.38.0","v0.39.0","v0.40.0","v0.41.0","v0.42.0","v0.43.0","v0.44.0","v0.45.0","v0.46.0","v0.47.0","v0.48.0","v0.49.0","v0.50.0","v0.51.0","v0.52.0","v0.53.0","v0.54.0","v0.55.0","v0.56.0","v0.57.0","v0.58.0","v0.59.0","v0.59.1","v0.60.0","v0.60.1","v0.61.0","v0.62.0","v0.62.1","v0.63.0","v0.64.0","v0.64.1","v0.65.0","v0.65.1","v0.66.0","v0.66.1","v0.67.0","v0.67.1","v0.68.0","v0.69.0","v0.69.1","v0.70.0","v0.71.0","v0.71.1","v0.72.0","v0.72.1","v0.73.0","v0.74.0","v0.75.0","v0.76.0","v1.0.0","v1.0.1","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.4.1","v1.5.0","v1.5.1","v1.6.0","v2.0.0+incompatible","v2.0.1+incompatible","v2.0.2+incompatible","v2.1.0+incompatible","v2.2.0+incompatible","v2.2.1+incompatible","v2.3.0+incompatible","v2.3.1+incompatible","v2.4.0+incompatible","v2.5.0+incompatible","v2.5.1+incompatible","v2.6.0+incompatible","v2.7.0+incompatible","v2.7.1+incompatible","v2.7.2+incompatible","v2.7.3+incompatible","v2.7.4+incompatible","v2.7.5+incompatible","v2.7.6+incompatible","v2.7.7+incompatible","v3.0.0+incompatible","v3.0.1+incompatible","v3.1.0+incompatible","v3.1.1+incompatible","v3.2.0+incompatible","v3.2.1+incompatible","v3.3.0+incompatible","v3.3.1+incompatible","v3.3.2+incompatible","v3.3.3+incompatible","v3.3.4+incompatible","v3.4.0+incompatible","v3.4.1+incompatible","v3.5.0+incompatible","v3.6.0+incompatible","v3.7.0+incompatible","v3.8.0+incompatible","v3.9.0+incompatible","v3.9.1+incompatible","v3.9.2+incompatible","v3.10.0+incompatible","v3.11.0+incompatible","v3.12.0+incompatible","v3.13.0+incompatible","v3.14.0+incompatible","v3.14.1+incompatible","v4.0.0+incompatible","v4.1.0+incompatible","v4.2.0+incompatible","v4.2.1+incompatible","v4.2.2+incompatible","v4.2.2-rc.133+incompatible","v4.2.3+incompatible"],"unaffected_versions":[]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01anAyLXZ3cmotOTlyZs4AAvd3/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk2ODktcng0di1jcWdj","url":"https://github.com/advisories/GHSA-9689-rx4v-cqgc","title":"Pivotal Concourse Open Redirect in Login Flow","description":"Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.\n\n### Specific Go Packages Affected\ngithub.com/concourse/concourse/skymarshal/skyserver","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-02-15T01:57:18.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-15798","https://github.com/concourse/concourse/pull/5350/commits/38cb4cc025e5ed28764b4adc363a0bbf41f3c7cb","https://github.com/concourse/concourse/blob/release/5.2.x/release-notes/v5.2.8.md","https://pivotal.io/security/cve-2018-15798","https://github.com/advisories/GHSA-9689-rx4v-cqgc"],"source_kind":"github","identifiers":["GHSA-9689-rx4v-cqgc","CVE-2018-15798"],"repository_url":"https://github.com/concourse/concourse","blast_radius":0.0,"created_at":"2022-12-21T16:13:04.259Z","updated_at":"2026-10-27T16:13:18.503Z","epss_percentage":0.01145,"epss_percentile":0.66523,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk2ODktcng0di1jcWdj","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk2ODktcng0di1jcWdj","packages":[{"ecosystem":"go","package_name":"github.com/concourse/concourse","versions":[{"first_patched_version":"5.8.1","vulnerable_version_range":"\u003e= 5.6.0, \u003c 5.8.1"},{"first_patched_version":"5.5.10","vulnerable_version_range":"\u003e= 5.3.0, \u003c 5.5.10"},{"first_patched_version":"5.2.8","vulnerable_version_range":"\u003c 5.2.8"}],"purl":"pkg:go/github.com%2Fconcourse%2Fconcourse","statistics":{"dependent_packages_count":21,"dependent_repos_count":22,"downloads":null,"downloads_period":null},"affected_versions":["v0.1.0","v0.1.0-rc.1","v0.1.0-rc.2","v0.1.0-rc.3","v0.1.0-rc.4","v0.1.0-rc.5","v0.1.0-rc.6","v0.1.0-rc.7","v0.2.0","v0.2.0-rc.1","v0.2.0-rc.2","v0.2.0-rc.3","v0.3.0","v0.3.0-rc.1","v0.3.0-rc.2","v0.3.0-rc.3","v0.3.0-rc.4","v0.3.0-rc.5","v0.3.0-rc.6","v0.3.0-rc.7","v0.3.0-rc.8","v0.3.0-rc.9","v0.3.0-rc.10","v0.3.0-rc.11","v0.3.0-rc.12","v0.3.0-rc.13","v0.3.0-rc.14","v0.3.0-rc.15","v0.3.0-rc.16","v0.3.0-rc.17","v0.3.0-rc.18","v0.3.0-rc.19","v0.3.0-rc.20","v0.3.0-rc.21","v0.3.0-rc.22","v0.3.0-rc.23","v0.3.0-rc.24","v0.3.0-rc.25","v0.3.0-rc.26","v0.3.0-rc.27","v0.3.0-rc.28","v0.3.0-rc.29","v0.3.0-rc.30","v0.3.0-rc.31","v0.3.0-rc.32","v0.3.0-rc.33","v0.4.0","v0.4.0-rc.1","v0.5.0","v0.5.0-rc.1","v0.5.0-rc.2","v0.5.0-rc.3","v0.5.0-rc.4","v0.5.0-rc.5","v0.5.0-rc.6","v0.5.0-rc.7","v0.5.0-rc.8","v0.5.0-rc.9","v0.5.0-rc.10","v0.5.0-rc.11","v0.5.0-rc.12","v0.5.0-rc.13","v0.5.0-rc.14","v0.5.0-rc.15","v0.5.0-rc.16","v0.5.0-rc.17","v0.5.0-rc.18","v0.5.0-rc.19","v0.5.0-rc.20","v0.6.0","v0.6.0-rc.1","v0.6.0-rc.2","v0.6.0-rc.3","v0.6.0-rc.4","v0.6.0-rc.5","v0.6.0-rc.6","v0.6.0-rc.7","v0.6.0-rc.8","v0.6.0-rc.9","v0.6.0-rc.10","v0.6.0-rc.11","v0.6.0-rc.12","v0.6.0-rc.13","v0.6.0-rc.14","v0.6.0-rc.15","v0.6.0-rc.16","v0.6.0-rc.17","v0.6.0-rc.18","v0.6.0-rc.19","v0.6.0-rc.20","v0.6.0-rc.21","v0.6.0-rc.22","v0.6.0-rc.23","v0.6.0-rc.24","v0.6.0-rc.25","v0.6.0-rc.26","v0.6.0-rc.27","v0.6.0-rc.28","v0.6.0-rc.29","v0.6.0-rc.30","v0.6.0-rc.31","v0.6.0-rc.32","v0.6.0-rc.33","v0.6.0-rc.34","v0.6.0-rc.35","v0.6.0-rc.36","v0.6.0-rc.37","v0.6.0-rc.38","v0.6.0-rc.39","v0.6.0-rc.40","v0.6.0-rc.41","v0.6.0-rc.42","v0.7.0","v0.7.0-rc.1","v0.7.0-rc.2","v0.7.0-rc.3","v0.7.0-rc.4","v0.7.0-rc.5","v0.7.0-rc.6","v0.7.0-rc.7","v0.7.0-rc.8","v0.7.0-rc.9","v0.7.0-rc.10","v0.7.0-rc.11","v0.7.0-rc.12","v0.7.0-rc.13","v0.7.0-rc.14","v0.7.0-rc.15","v0.7.0-rc.16","v0.7.0-rc.17","v0.7.0-rc.18","v0.7.0-rc.19","v0.7.0-rc.20","v0.7.0-rc.21","v0.7.0-rc.22","v0.7.0-rc.23","v0.7.0-rc.24","v0.7.0-rc.25","v0.7.0-rc.26","v0.7.0-rc.27","v0.7.0-rc.28","v0.7.0-rc.29","v0.7.0-rc.30","v0.7.0-rc.31","v0.7.0-rc.32","v0.7.0-rc.33","v0.7.0-rc.34","v0.7.0-rc.35","v0.7.0-rc.36","v0.7.0-rc.37","v0.8.0","v0.8.0-rc.1","v0.9.0","v0.10.0","v0.11.0","v0.12.0","v0.13.0","v0.14.0","v0.15.0","v0.16.0","v0.17.0","v0.18.0","v0.19.0","v0.20.0","v0.21.0","v0.22.0","v0.23.0","v0.24.0","v0.25.0","v0.26.0","v0.27.0","v0.28.0","v0.29.0","v0.30.0","v0.31.0","v0.32.0","v0.33.0","v0.34.0","v0.35.0","v0.36.0","v0.37.0","v0.38.0","v0.39.0","v0.40.0","v0.41.0","v0.42.0","v0.43.0","v0.44.0","v0.45.0","v0.46.0","v0.47.0","v0.48.0","v0.49.0","v0.50.0","v0.51.0","v0.52.0","v0.53.0","v0.54.0","v0.55.0","v0.56.0","v0.57.0","v0.58.0","v0.59.0","v0.59.1","v0.60.0","v0.60.1","v0.61.0","v0.62.0","v0.62.1","v0.63.0","v0.64.0","v0.64.1","v0.65.0","v0.65.1","v0.66.0","v0.66.1","v0.67.0","v0.67.1","v0.68.0","v0.69.0","v0.69.1","v0.70.0","v0.71.0","v0.71.1","v0.72.0","v0.72.1","v0.73.0","v0.74.0","v0.75.0","v0.76.0","v1.0.0","v1.0.1","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.4.1","v1.5.0","v1.5.1","v1.6.0","v2.0.0+incompatible","v2.0.1+incompatible","v2.0.2+incompatible","v2.1.0+incompatible","v2.2.0+incompatible","v2.2.1+incompatible","v2.3.0+incompatible","v2.3.1+incompatible","v2.4.0+incompatible","v2.5.0+incompatible","v2.5.1+incompatible","v2.6.0+incompatible","v2.7.0+incompatible","v2.7.1+incompatible","v2.7.2+incompatible","v2.7.3+incompatible","v2.7.4+incompatible","v2.7.5+incompatible","v2.7.6+incompatible","v2.7.7+incompatible","v3.0.0+incompatible","v3.0.1+incompatible","v3.1.0+incompatible","v3.1.1+incompatible","v3.2.0+incompatible","v3.2.1+incompatible","v3.3.0+incompatible","v3.3.1+incompatible","v3.3.2+incompatible","v3.3.3+incompatible","v3.3.4+incompatible","v3.4.0+incompatible","v3.4.1+incompatible","v3.5.0+incompatible","v3.6.0+incompatible","v3.7.0+incompatible","v3.8.0+incompatible","v3.9.0+incompatible","v3.9.1+incompatible","v3.9.2+incompatible","v3.10.0+incompatible","v3.11.0+incompatible","v3.12.0+incompatible","v3.13.0+incompatible","v3.14.0+incompatible","v3.14.1+incompatible","v4.0.0+incompatible","v4.1.0+incompatible","v4.2.0+incompatible","v4.2.1+incompatible","v4.2.2+incompatible","v4.2.2-rc.133+incompatible","v4.2.3+incompatible"],"unaffected_versions":[]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk2ODktcng0di1jcWdj/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRmcXgtNzRydi02Mzh3","url":"https://github.com/advisories/GHSA-4fqx-74rv-638w","title":"Pivotal Concourse SQL Injection Vulnerability","description":"Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-02-15T01:57:18.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2019-3792","https://github.com/concourse/concourse/commit/dc3d15ab6c3a69890c9985f9c875d4c2949be727","https://github.com/concourse/concourse/blob/master/release-notes/v5.0.1.md#v501-note-1","https://pivotal.io/security/cve-2019-3792","https://github.com/advisories/GHSA-4fqx-74rv-638w"],"source_kind":"github","identifiers":["GHSA-4fqx-74rv-638w","CVE-2019-3792"],"repository_url":"https://github.com/concourse/concourse","blast_radius":0.0,"created_at":"2022-12-21T16:13:04.242Z","updated_at":"2026-10-16T06:12:51.040Z","epss_percentage":0.01091,"epss_percentile":0.64532,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRmcXgtNzRydi02Mzh3","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRmcXgtNzRydi02Mzh3","packages":[{"ecosystem":"go","package_name":"github.com/concourse/concourse","versions":[{"first_patched_version":"5.0.1","vulnerable_version_range":"\u003c 5.0.1"}],"purl":"pkg:go/github.com%2Fconcourse%2Fconcourse"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRmcXgtNzRydi02Mzh3/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyN3AtcnI3OC05OXJq","url":"https://github.com/advisories/GHSA-627p-rr78-99rj","title":"GitLab auth uses full name instead of username as user ID, allowing impersonation","description":"### Impact\n\nInstallations which use the GitLab auth connector are vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another GitLab user who is granted access to a Concourse team by having their full name listed under `users` in the team configuration or given to the `--gitlab-user` flag.\n\nSee the [GitLab auth docs](https://concourse-ci.org/gitlab-auth.html) for details.\n\nConcourse installations which do not configure the GitLab auth connector are not affected.\n\n### Patches\n\nConcourse [v6.3.1](https://github.com/concourse/concourse/releases/tag/v6.3.1) and [v6.4.1](https://github.com/concourse/concourse/releases/tag/v6.4.1) were both released with a fix on August 4th, 2020.\n\nBoth versions change the GitLab connector to use the username, rather than the full name. This was always the intent, and the previous behavior was originally reported as a bug (concourse/dex#7) prior to being reported as a security issue.\n\nAny Concourse teams which configure GitLab users will have to switch each user from their full name to their username upon upgrading to these versions.\n\n### Workarounds\n\nGitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.\n\n### References\n\n* concourse/dex#12: PR with the fix\n\n### For more information\n\nIf you have any questions or comments about this advisory, you may reach us privately at [concourseteam+security@gmail.com](mailto:concourseteam+security@gmail.com).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-12-20T17:56:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj","https://nvd.nist.gov/vuln/detail/CVE-2020-5415","https://tanzu.vmware.com/security/cve-2020-5415","https://github.com/advisories/GHSA-627p-rr78-99rj"],"source_kind":"github","identifiers":["GHSA-627p-rr78-99rj","CVE-2020-5415"],"repository_url":"https://github.com/concourse/concourse","blast_radius":0.0,"created_at":"2022-12-21T16:12:40.244Z","updated_at":"2026-10-27T16:17:14.330Z","epss_percentage":0.01217,"epss_percentile":0.67512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyN3AtcnI3OC05OXJq","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyN3AtcnI3OC05OXJq","packages":[{"ecosystem":"go","package_name":"github.com/concourse/concourse","versions":[{"first_patched_version":"1.6.1-0.20200730151558-b00d1c8d8576","vulnerable_version_range":"\u003e= 0.0.0, \u003c 1.6.1-0.20200730151558-b00d1c8d8576"},{"first_patched_version":"6.3.1","vulnerable_version_range":"\u003e= 1.6.1, \u003c= 6.3.0"},{"first_patched_version":"0.0.0-20200730151558-b00d1c8d8576","vulnerable_version_range":"\u003c 0.0.0-20200730151558-b00d1c8d8576"},{"first_patched_version":"6.4.1","vulnerable_version_range":"= 6.4.0"}],"purl":"pkg:go/github.com%2Fconcourse%2Fconcourse","statistics":{"dependent_packages_count":21,"dependent_repos_count":22,"downloads":null,"downloads_period":null},"affected_versions":["v0.1.0","v0.1.0-rc.1","v0.1.0-rc.2","v0.1.0-rc.3","v0.1.0-rc.4","v0.1.0-rc.5","v0.1.0-rc.6","v0.1.0-rc.7","v0.2.0","v0.2.0-rc.1","v0.2.0-rc.2","v0.2.0-rc.3","v0.3.0","v0.3.0-rc.1","v0.3.0-rc.2","v0.3.0-rc.3","v0.3.0-rc.4","v0.3.0-rc.5","v0.3.0-rc.6","v0.3.0-rc.7","v0.3.0-rc.8","v0.3.0-rc.9","v0.3.0-rc.10","v0.3.0-rc.11","v0.3.0-rc.12","v0.3.0-rc.13","v0.3.0-rc.14","v0.3.0-rc.15","v0.3.0-rc.16","v0.3.0-rc.17","v0.3.0-rc.18","v0.3.0-rc.19","v0.3.0-rc.20","v0.3.0-rc.21","v0.3.0-rc.22","v0.3.0-rc.23","v0.3.0-rc.24","v0.3.0-rc.25","v0.3.0-rc.26","v0.3.0-rc.27","v0.3.0-rc.28","v0.3.0-rc.29","v0.3.0-rc.30","v0.3.0-rc.31","v0.3.0-rc.32","v0.3.0-rc.33","v0.4.0","v0.4.0-rc.1","v0.5.0","v0.5.0-rc.1","v0.5.0-rc.2","v0.5.0-rc.3","v0.5.0-rc.4","v0.5.0-rc.5","v0.5.0-rc.6","v0.5.0-rc.7","v0.5.0-rc.8","v0.5.0-rc.9","v0.5.0-rc.10","v0.5.0-rc.11","v0.5.0-rc.12","v0.5.0-rc.13","v0.5.0-rc.14","v0.5.0-rc.15","v0.5.0-rc.16","v0.5.0-rc.17","v0.5.0-rc.18","v0.5.0-rc.19","v0.5.0-rc.20","v0.6.0","v0.6.0-rc.1","v0.6.0-rc.2","v0.6.0-rc.3","v0.6.0-rc.4","v0.6.0-rc.5","v0.6.0-rc.6","v0.6.0-rc.7","v0.6.0-rc.8","v0.6.0-rc.9","v0.6.0-rc.10","v0.6.0-rc.11","v0.6.0-rc.12","v0.6.0-rc.13","v0.6.0-rc.14","v0.6.0-rc.15","v0.6.0-rc.16","v0.6.0-rc.17","v0.6.0-rc.18","v0.6.0-rc.19","v0.6.0-rc.20","v0.6.0-rc.21","v0.6.0-rc.22","v0.6.0-rc.23","v0.6.0-rc.24","v0.6.0-rc.25","v0.6.0-rc.26","v0.6.0-rc.27","v0.6.0-rc.28","v0.6.0-rc.29","v0.6.0-rc.30","v0.6.0-rc.31","v0.6.0-rc.32","v0.6.0-rc.33","v0.6.0-rc.34","v0.6.0-rc.35","v0.6.0-rc.36","v0.6.0-rc.37","v0.6.0-rc.38","v0.6.0-rc.39","v0.6.0-rc.40","v0.6.0-rc.41","v0.6.0-rc.42","v0.7.0","v0.7.0-rc.1","v0.7.0-rc.2","v0.7.0-rc.3","v0.7.0-rc.4","v0.7.0-rc.5","v0.7.0-rc.6","v0.7.0-rc.7","v0.7.0-rc.8","v0.7.0-rc.9","v0.7.0-rc.10","v0.7.0-rc.11","v0.7.0-rc.12","v0.7.0-rc.13","v0.7.0-rc.14","v0.7.0-rc.15","v0.7.0-rc.16","v0.7.0-rc.17","v0.7.0-rc.18","v0.7.0-rc.19","v0.7.0-rc.20","v0.7.0-rc.21","v0.7.0-rc.22","v0.7.0-rc.23","v0.7.0-rc.24","v0.7.0-rc.25","v0.7.0-rc.26","v0.7.0-rc.27","v0.7.0-rc.28","v0.7.0-rc.29","v0.7.0-rc.30","v0.7.0-rc.31","v0.7.0-rc.32","v0.7.0-rc.33","v0.7.0-rc.34","v0.7.0-rc.35","v0.7.0-rc.36","v0.7.0-rc.37","v0.8.0","v0.8.0-rc.1","v0.9.0","v0.10.0","v0.11.0","v0.12.0","v0.13.0","v0.14.0","v0.15.0","v0.16.0","v0.17.0","v0.18.0","v0.19.0","v0.20.0","v0.21.0","v0.22.0","v0.23.0","v0.24.0","v0.25.0","v0.26.0","v0.27.0","v0.28.0","v0.29.0","v0.30.0","v0.31.0","v0.32.0","v0.33.0","v0.34.0","v0.35.0","v0.36.0","v0.37.0","v0.38.0","v0.39.0","v0.40.0","v0.41.0","v0.42.0","v0.43.0","v0.44.0","v0.45.0","v0.46.0","v0.47.0","v0.48.0","v0.49.0","v0.50.0","v0.51.0","v0.52.0","v0.53.0","v0.54.0","v0.55.0","v0.56.0","v0.57.0","v0.58.0","v0.59.0","v0.59.1","v0.60.0","v0.60.1","v0.61.0","v0.62.0","v0.62.1","v0.63.0","v0.64.0","v0.64.1","v0.65.0","v0.65.1","v0.66.0","v0.66.1","v0.67.0","v0.67.1","v0.68.0","v0.69.0","v0.69.1","v0.70.0","v0.71.0","v0.71.1","v0.72.0","v0.72.1","v0.73.0","v0.74.0","v0.75.0","v0.76.0","v1.0.0","v1.0.1","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.4.1","v1.5.0","v1.5.1","v1.6.0","v2.0.0+incompatible","v2.0.1+incompatible","v2.0.2+incompatible","v2.1.0+incompatible","v2.2.0+incompatible","v2.2.1+incompatible","v2.3.0+incompatible","v2.3.1+incompatible","v2.4.0+incompatible","v2.5.0+incompatible","v2.5.1+incompatible","v2.6.0+incompatible","v2.7.0+incompatible","v2.7.1+incompatible","v2.7.2+incompatible","v2.7.3+incompatible","v2.7.4+incompatible","v2.7.5+incompatible","v2.7.6+incompatible","v2.7.7+incompatible","v3.0.0+incompatible","v3.0.1+incompatible","v3.1.0+incompatible","v3.1.1+incompatible","v3.2.0+incompatible","v3.2.1+incompatible","v3.3.0+incompatible","v3.3.1+incompatible","v3.3.2+incompatible","v3.3.3+incompatible","v3.3.4+incompatible","v3.4.0+incompatible","v3.4.1+incompatible","v3.5.0+incompatible","v3.6.0+incompatible","v3.7.0+incompatible","v3.8.0+incompatible","v3.9.0+incompatible","v3.9.1+incompatible","v3.9.2+incompatible","v3.10.0+incompatible","v3.11.0+incompatible","v3.12.0+incompatible","v3.13.0+incompatible","v3.14.0+incompatible","v3.14.1+incompatible","v4.0.0+incompatible","v4.1.0+incompatible","v4.2.0+incompatible","v4.2.1+incompatible","v4.2.2+incompatible","v4.2.2-rc.133+incompatible","v4.2.3+incompatible"],"unaffected_versions":[]},{"ecosystem":"go","package_name":"github.com/concourse/dex","versions":[{"first_patched_version":"6.3.1","vulnerable_version_range":"\u003e= 0.0.0, \u003c 6.3.0"},{"first_patched_version":"0.0.0-20200730150203-821b48abfd88","vulnerable_version_range":"\u003c 0.0.0-20200730150203-821b48abfd88"},{"first_patched_version":"6.4.1","vulnerable_version_range":"= 6.4.0"}],"purl":"pkg:go/github.com%2Fconcourse%2Fdex","statistics":{"dependent_packages_count":5,"dependent_repos_count":39,"downloads":null,"downloads_period":null},"affected_versions":["v0.1.0","v0.2.0","v0.2.1","v0.3.0","v0.4.0","v0.5.0","v0.6.0","v0.7.0","v0.8.0","v0.9.0","v0.10.0","v1.0.0","v1.1.0","v1.2.0","v1.3.0","v1.4.0","v1.5.0","v1.6.0","v1.7.0","v1.8.0","v1.9.0","v1.10.0","v1.11.0","v1.12.0","v1.13.0","v1.14.0"],"unaffected_versions":[]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyN3AtcnI3OC05OXJq/related_packages","related_advisories":[]}]