GitHub Advisoryadvisory · Maven

GHSA-wg26-8wmj-cf9p Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

MEDIUM Published 2026-04-29 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-42522
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:github-branch-source
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-05-06

Affected packages

• Maven org.jenkins-ci.plugins:github-branch-source: < 1967.1969.v205fd594c821 → fixed in 1967.1969.v205fd594c821

Description

Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier do not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials. GitHub Branch Source Plugin 1967.1969.v205fd594c821 requires Overall/Manage permission to perform the connection test.

Related

Alias · CVE (1)

  • CVE-2026-42522 A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References