All vulnerabilities
CVE-2026-57285GHSA-g7c6-wxjf-8564

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

Jenkins Project org.jenkins-ci.plugins:github-branch-sourcemavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1967.1970Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 1967.1970org.jenkins-ci.plugins:github-branch-source, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>github-branch-source</artifactId><version>1967.1970</version></dependency>
  • 1967.1970org.jenkins-ci.plugins:github-branch-source, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>github-branch-source</artifactId><version>1967.1970</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier does not perform a permission check in an HTTP endpoint that lists the GitHub API endpoints configured in the global plugin configuration.

This allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured by administrators.

This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. GitHub Branch Source Plugin 1967.1970.vd86979736546 requires Overall/Manage permission or Item/Extended Read permission on an item to list the configured GitHub API endpoints.

Text from GitHub Advisory Database

Affected versions 53

  • org.jenkins-ci.plugins:github-branch-source, maven< 1967.1970GitHub
  • Jenkins GitHub Branch Source Pluginaffected: all versions through 1967.1969.v205fd594c821CVE List
  • org.jenkins-ci.plugins:github-branch-source, Mavenfrom first release, fixed in 1967.1970OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven0.1-beta-1OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven0.1-beta-2OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven0.1-beta-3OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven0.1-beta-4OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.0OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.1OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.10OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.10.1OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.2OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.3OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.4OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.4-beta-1OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.5OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.6OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.7OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.8OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.8.1OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1.9OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1577.v83564088883fOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1583.v18d333ef7379OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1598.v91207e9f9b_4a_OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1599.v9fb_798a_a_7c4fOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1602.vfe89fe441b_36OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1619.v962f131fa_c15OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1628.vb_2f51293cb_78OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1637.vd833b_7ca_7654OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1656.v77eddb_b_e95dfOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1677.v731f745ea_0cfOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1687.v7618247e672dOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1694.vd46793a_c4a_57OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1695.v88de84e9f6b_9OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1696.v3a_7603564d04OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1701.v00cc8184df93OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1703.vd5a_2b_29c6cdcOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1725.vd391eef681a_eOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1728.v859147241f49OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1730.vff97c8a_1f804OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1732.v3f1889a_c475b_OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1734.v8a_ed3a_653490OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1740.v51d5810e9e8cOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1741.va_3028eb_9fd21OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1748.v6b_61a_1dc35b_4OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1750.v6b_fb_8df8f985OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1751.v90e17c48a_6a_cOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1752.vc201a_0235d80OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1755.vcdb_d136f3b_25OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1758.v048414714f5dOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1767.va_7d01ea_c7256OSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1771.v59b_6a_fa_1b_89eOSV
  • org.jenkins-ci.plugins:github-branch-source, Maven1772.va_69eda_d018d4OSV

References 5