Jenkins Project Jenkins GitHub Branch Source Plugin vulnerabilities

Latest Jenkins Project Jenkins GitHub Branch Source Plugin CVEs

Newest publication first

1. CVE-2026-57285 Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

   Published 2026-06-24

   Medium·CVSS 4.3 EPSS 0.28%

   A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

2. CVE-2026-42522 Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

   Published 2026-04-29

   Medium·CVSS 4.3 EPSS 0.18%

   A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.