Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-57285 EUVD-2026-38765GHSA-g7c6-wxjf-8564

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

Published Jun 24, 2026 · Updated Jun 24, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins GitHub Branch Source Plugin Package: org.jenkins-ci.plugins:github-branch-source Category: Web / CMS Ecosystem: Maven

Description

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins GitHub Branch Source Plugin ≤ 1967.1969.v205fd594c821 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:github-branch-source < 1967.1970 1967.1970 GHSA-g7c6-wxjf-8564

Advisories 1

References