CVE-2017-1000091: Jenkins GitHub Branch Source Plugin Cross-Site Request Forgery
Summary
CVE-2017-1000091: Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery. Affects org.jenkins-ci.plugins:github-branch-source versions < 2.2.0-alpha-1. Fixed in 2.2.0-alpha-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Branch Source Plugin is a Maven package that connects to a user-specified GitHub API URL, such as GitHub Enterprise. It is used for form validation and completion, including verifying Scan Credentials. However, this functionality had a vulnerability that allowed any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, potentially capturing them. The vulnerability also allowed this action to be performed via Cross-Site Request Forgery without direct access to Jenkins.
Vulnerability Detail
The vulnerability in the Jenkins GitHub Branch Source Plugin allowed unauthorized users to connect to arbitrary web servers and send credentials with a known ID. This could lead to the capture of sensitive information. The plugin did not properly check permissions, allowing users with Overall/Read access to exploit the vulnerability. Additionally, the plugin did not require POST requests, making it susceptible to Cross-Site Request Forgery attacks. To mitigate this vulnerability, the plugin now requires Extended Read or Configure permission to access credentials IDs in the job context.
How To Fix
Latest published version: 1986.v801e40614d00 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0-alpha-1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins GitHub Branch Source Plugin was vulnerable to Cross-Site Request Forgery, allowing unauthorized users to connect to arbitrary web servers and send credentials. This could result in the capture of sensitive information. Upgrading to version 2.2.0-alpha-1 or later of the plugin is recommended to mitigate this vulnerability. For more information and support, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:github-branch-source →
FAQ
The vulnerability allows unauthorized users to connect to arbitrary web servers and send credentials, potentially leading to the capture of sensitive information.
Users of the Jenkins GitHub Branch Source Plugin versions prior to 2.2.0-alpha-1 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and Vulert will monitor and alert in real-time for open-source vulnerabilities in your software.
Yes, the CVSS score for this vulnerability is 6.3.
For further support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:github-branch-source.
