Security: concourse/concourse
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
DOS via HeartbeatWorker endpointGHSA-hg62-49fv-33pp published
Aug 17, 2026 by taylorsilvaModerate -
User with Worker's team private key can land/retire other team's workersGHSA-2w8g-h943-5fqh published
Aug 17, 2026 by taylorsilvaLow -
Path traversal during secrets lookupGHSA-vc3v-p3pr-4f5x published
Aug 3, 2026 by taylorsilvaLow -
Open redirect in Concourse login flowGHSA-8w27-c4vc-88q9 published
May 27, 2026 by taylorsilvaLow -
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollutionGHSA-5jp2-vwrj-99rf published
Oct 19, 2022 by rui42Moderate -
GitLab auth uses full name instead of username as user ID, allowing impersonationGHSA-627p-rr78-99rj published
Aug 11, 2020 by vitoCritical