Description
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins GitHub Branch Source Plugin | ≤ 1967.vdea_d580c1a_b_a_ | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:github-branch-source | < 1967.1969.v205fd594c821 | 1967.1969.v205fd594c821 | GHSA-wg26-8wmj-cf9p |
Advisories 1
- WID-SEC-2026-1320 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 29, 2026
References
- Jenkins Security Advisory 2026-04-29 vendor-advisory