Gradle Technologies is now Develocity — read the announcement

Develocity Security Advisories

The following is a list of security advisories relating to Develocity and its associated components. Gradle Build Tool security advisories can be found on GitHub.

2025

PublishedSeveritySummary
Jul 21, 2025HighCCUD plugins information exposure
Jan 22, 2025HighPassword hash information exposure

2024

PublishedSeveritySummary
Oct 1, 2024ModerateProject-Level Access Control may be disabled upon upgrade
Oct 1, 2024LowCredential leak of AWS credentials via local information exposure
May 2, 2024ModerateCross-Site Request Forgery on Develocity API calls

2023

PublishedSeveritySummary
Dec 4, 2023ModerateNon-unique initial system user password may allow unauthorized access to new installation

2022

PublishedSeveritySummary
Nov 26, 2022ModerateExposure of HTTP proxy password in the Gradle Enterprise administration user interface
Nov 26, 2022HighJSON deserialization vulnerability allows remote attacker to cause denial of service via maliciously crafted HTTP request
Oct 20, 2022ModerateDocker Hub access credential exposure in Replicated-based installation support bundles
Oct 19, 2022ModerateExposure of S3 access credentials in support bundles
Oct 4, 2022HighUnrestricted access to application HTTP endpoint allows arbitrarily emailing installation admin contact and preventing backups
Jun 29, 2022LowWeak cipher suite enabled on Build Cache Node
Jun 3, 2022ModerateEncryption key used for external system passwords is readable in created Kubernetes manifests
Jun 3, 2022LowSystem password reset via Admin CLI allows command injection and password leakage
Apr 22, 2022HighPotential information disclosure and remote code execution via TLS bypass due to Java ECDSA cryptographic bypass vulnerability
Apr 19, 2022LowPotential remote-code-execution and denial-of-service via zlib dependency
Apr 4, 2022LowLibraries vulnerable to Spring4Shell are distributed with Gradle Enterprise
Mar 24, 2022HighDefault installation configuration allows anonymous access to some admin configuration
Mar 24, 2022ModeratePotential remote code execution via database connection parameters
Mar 15, 2022LowKeycloak legacy cookies are not secured
Mar 9, 2022CriticalPotential remote code execution when running Gradle Enterprise built-in build cache with default configuration
Jan 7, 2022ModerateHTTP request smuggling vulnerability due to use of Netty

2021

PublishedSeveritySummary
Dec 13, 2021CriticalRemote code execution vulnerability due to use of Log4j2
Oct 25, 2021HighOpen redirect vulnerability in Replicated admin console
Oct 21, 2021HighInstallation configuration information exposure in Replicated admin console
Oct 15, 2021ModeratePotential probing of server side network environment via SMTP configuration test
Oct 15, 2021CriticalPotential remote code execution when running build cache node with default configuration
May 31, 2021HighPotential remote code execution via application startup configuration
May 31, 2021HighAttacker with SSRF ability can reset system user password
May 31, 2021HighAttacker with SSRF capability can obtain application secrets
May 31, 2021HighMaliciously crafted HTTP request to Gradle Enterprise may allow remote code execution
May 31, 2021CriticalCrafted HTTP request to Gradle Enterprise can allow unauthorized viewing of response
Feb 8, 2021HighPotential compromise of build or agent environment by test distribution agent or client imposter

2020

PublishedSeveritySummary
Sep 18, 2020HighBuild scan Export API is susceptible to cross-origin requests
Sep 15, 2020HighCSRF prevention token is overridable by user code
Sep 15, 2020ModerateBuild project names and build volumes are accessible without authentication
Sep 15, 2020ModerateLogin sessions are not terminated on browser closure
Sep 15, 2020ModerateSAML IDP metadata XML upload is vulnerable to server-side request forgery via XXE injection
Sep 15, 2020ModerateRequest cookies containing CSRF prevention token are not same-site restricted
Sep 15, 2020ModerateLocal user login is susceptible to brute force password guessing
Sep 15, 2020CriticalTest distribution usage search form allows XSS
Sep 15, 2020CriticalPotential disclosure of session cookies via header reflection
Sep 15, 2020ModerateCSRF prevention cookie is susceptible to capture by MITM on HTTP redirect
Jul 15, 2020CriticalPotential local privilege escalation during build due to unrestricted input deserialization

2019

PublishedSeveritySummary
Apr 22, 2019HighBuild cache credentials are reflected in administration screens
Apr 22, 2019HighBuild cache credentials are stored unencrypted at rest

© 2026 Gradle, Inc. Gradle®, Develocity®, Build Scan®, and the Gradlephant logo are registered trademarks of Gradle, Inc.

Get an AI summary of Develocity: