medium4.3
CVE-2026-57285
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain t…
Impact
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:github-branch-source | < 1967.1970 | 1967.1970 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Github Branch Source | through 1967.1969.v205fd594c821 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-g7c6-wxjf-8564
- https://nvd.nist.gov/vuln/detail/CVE-2026-57285
- https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3808
- https://github.com/jenkinsci/github-branch-source-plugin/commit/d869797365462234fe061c74fe6bf0bcae8777ea
- https://github.com/jenkinsci/github-branch-source-plugin/releases/tag/1967.1970.vd86979736546