To report a security issue, please send an email to security@concourse-ci.org. Thank you!
Only the latest release gets security patches.
If you're looking for security patches for an EOL version of Concourse, please reach out to Pixel Air IO.
Security: concourse/concourse
Security
SECURITY.md
-
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollutionGHSA-5jp2-vwrj-99rf published
Oct 19, 2022 by rui42Moderate -
GitLab auth uses full name instead of username as user ID, allowing impersonationGHSA-627p-rr78-99rj published
Aug 11, 2020 by vitoCritical
Learn more about advisories related to concourse/concourse in the GitHub Advisory Database