CVE-2017-1000087: Jenkins GitHub Branch Source Plugin Credential Enumeration
Summary
CVE-2017-1000087: GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. Affects org.jenkins-ci.plugins:github-branch-source versions < 2.2.0-alpha-1. Fixed in 2.2.0-alpha-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Branch Source Plugin is a Maven package that provides functionality for integrating GitHub repositories as a source for Jenkins jobs. It allows users to configure jobs and select the appropriate credentials for authentication. The plugin did not check permissions when providing a list of valid credential IDs, allowing any user with Overall/Read permission to access this information. This vulnerability could be exploited to capture credentials and potentially gain unauthorized access to sensitive resources.
Vulnerability Detail
The vulnerability in the Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to obtain a list of valid credential IDs. This information can be used in conjunction with other vulnerabilities to capture the credentials and potentially compromise the system. The plugin now requires Extended Read permission (or Configure permission if Extended Read is not enabled) to access the list of credential IDs. If no job context exists, Overall/Administer permission is required.
How To Fix
Latest published version: 1986.v801e40614d00 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0-alpha-1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to update the plugin to the latest version as soon as possible.
Conclusion
The Jenkins GitHub Branch Source Plugin is vulnerable to a credential enumeration issue, allowing any user with Overall/Read permission to obtain a list of valid credential IDs. This information can be used in conjunction with other vulnerabilities to capture credentials and potentially compromise the system. To mitigate this vulnerability, it is recommended to update the plugin to version 2.2.0-alpha-1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:github-branch-source →
FAQ
This vulnerability allows any user with Overall/Read permission to obtain a list of valid credential IDs, which can be used to capture credentials and potentially gain unauthorized access to sensitive resources.
Any user with Overall/Read permission can exploit this vulnerability to obtain the list of valid credential IDs. If Extended Read permission is enabled, it is required to access the list in the context of a job. Otherwise, Configure permission is sufficient. If no job context exists, Overall/Administer permission is required.
To protect your Jenkins instance, it is recommended to update the Jenkins GitHub Branch Source Plugin to version 2.2.0-alpha-1 or later. This version includes the fix that restricts access to the list of credential IDs based on the appropriate permissions.
There are no known exploits specifically targeting this vulnerability at the moment. However, it is important to apply the recommended fix to prevent potential exploitation.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6jp2-hggx-8j7p/GHSA-6jp2-hggx-8j7p.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:github-branch-source.
