CVE-2026-57285
Analyzed Analyzed - Analysis Complete

Missing Permission Check in Jenkins GitHub Branch Source Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-24
Last Modified
2026-06-26
Generated
2026-07-15
AI Q&A
2026-06-24
EPSS Evaluated
2026-07-13
NVD
CVE-2026-57285
EUVD
EUVD-2026-38765

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkins github_branch_source to 1967.1969.v205fd594c821 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing permission check in the Jenkins GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier. It allows attackers who have Overall/Read permission to access the URLs of GitHub Enterprise servers that are configured in the global plugin configuration.

Impact Analysis

An attacker with Overall/Read permission could exploit this vulnerability to obtain sensitive information about the URLs of GitHub Enterprise servers configured in Jenkins. This could potentially expose internal infrastructure details that might be used for further attacks or reconnaissance.

Detection Guidance

This vulnerability involves a missing permission check in the Jenkins GitHub Branch Source Plugin allowing attackers with Overall/Read permission to obtain URLs of GitHub Enterprise servers configured in the global plugin configuration.

Detection would involve checking the version of the Jenkins GitHub Branch Source Plugin installed on your system to see if it is 1967.1969.v205fd594c821 or earlier.

You can detect the plugin version by running the following command on the Jenkins server:

  • curl -sSL http://<jenkins-server>/pluginManager/api/json?depth=1 | jq '.plugins[] | select(.shortName=="github-branch-source") | {version}'

If the version is at or below 1967.1969.v205fd594c821, your system is vulnerable.

Mitigation Strategies

The immediate mitigation step is to upgrade the Jenkins GitHub Branch Source Plugin to a version later than 1967.1969.v205fd594c821 where the missing permission check has been fixed.

Additionally, review and restrict the Overall/Read permissions in Jenkins to only trusted users to reduce the risk of exploitation.

If upgrading immediately is not possible, consider limiting access to the Jenkins instance and monitoring for unusual access patterns to the plugin configuration.

Compliance Impact

The provided information does not specify how the vulnerability in Jenkins GitHub Branch Source Plugin affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart