GitHub Advisoryadvisory · Maven

GHSA-jwhr-h7pc-3974 Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation

MEDIUM Published 2026-06-24 Modified 2026-09-25 Official page ↗
Aliases
CVE-2026-57289
Ecosystem
Maven
Packages
io.jenkins.plugins:bitbucket-push-and-pull-request
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-295
Reviewed
2026-09-25

Affected packages

• Maven io.jenkins.plugins:bitbucket-push-and-pull-request: < 3.3.9 → fixed in 3.3.9

Description

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the connections it makes to Bitbucket Server using Bearer token authentication. Because the Bearer token is transmitted in these requests, this allows attackers able to intercept network traffic to capture the token and impersonate the Jenkins controller to Bitbucket Server. Bitbucket Push and Pull Request Plugin 3.3.9 validates SSL/TLS certificates and hostnames for the connections it makes to Bitbucket Server using Bearer token authentication, using the trust store configured for the Jenkins controller JVM.

Related

Alias · CVE (1)

  • CVE-2026-57289 Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References