CVE-2022-31683: Open Source Vulnerability in github.com/concourse/concourse
Summary
CVE-2022-31683: Impact For some Post/Put Concourse endpoint containing :team_name in the URL, a Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong... Affects github.com/concourse/concourse across 2 version ranges.
< 6.7.9
>= 7.0.0, < 7.8.3
Fixed in 6.7.9 or 7.8.3, depending on the release line you run. How to fix ↓
Also tracked for
- concourse · Bitnami
The same CVE-2022-31683 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/concourse/concourse is an open-source tool used for continuous integration and delivery. It provides a platform for automating software builds, tests, and deployments. Concourse allows users to define pipelines that consist of jobs and resources. Each team in Concourse has its own set of pipelines and resources. However, a vulnerability in Concourse allows an attacker to bypass team scope authorization and gain access to resources belonging to other teams.
Vulnerability Detail
The vulnerability (CVE-2022-31683) in Concourse allows an attacker with a valid user session in one team to send a crafted request with the :team_name parameter in the body to bypass team scope checks. This allows the attacker to gain access to certain resources belonging to any other team. The impact of this vulnerability is that an attacker can perform actions such as pausing pipelines, rerunning job builds, scheduling jobs, and manipulating resources in other teams. The vulnerability is rated as moderate with a CVSS score of 5.4.
How To Fix
Latest published version: v4.2.3+incompatible as of 23 Oct 2026
go get github.com/concourse/concourse@v4.2.3+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.7.96.7.9go get github.com/concourse/concourse@v6.7.9 -
>= 7.0.0, < 7.8.37.8.3go get github.com/concourse/concourse@v7.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to update to the patched versions of Concourse as soon as possible.
Conclusion
The vulnerability in github.com/concourse/concourse allows an attacker to bypass team scope authorization and gain unauthorized access to resources belonging to other teams. Users are advised to update their Concourse installation to the patched versions (6.7.9 or 7.8.3) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/concourse/concourse →
FAQ
The vulnerability allows an attacker to bypass team scope authorization and gain access to resources belonging to other teams in Concourse.
You can use the Vulert Playground at Vulert Scanner to check if your Concourse installation is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
No, there are no known workarounds for this vulnerability. It is recommended to update to the patched versions of Concourse.
No, an attacker requires a valid user session in one team to exploit this vulnerability.
There is no evidence of this vulnerability being exploited in the wild at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/concourse/concourse.
