CVE-2018-1000186: Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability
Summary
CVE-2018-1000186: Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability. Affects org.jenkins-ci.plugins:ghprb versions < 1.42.0. Fixed in 1.42.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Pull Request Builder Plugin is a plugin for the Jenkins automation server that allows users to trigger builds on GitHub pull requests. It provides integration with GitHub and allows users to configure build triggers based on pull request events. The plugin is widely used in software development workflows to automate the building and testing of code changes submitted through pull requests.
Vulnerability Detail
The Jenkins GitHub Pull Request Builder Plugin versions 1.41.0 and older are vulnerable to a credential capture vulnerability. This vulnerability allows attackers with Overall/Read access to connect to a specified URL using attacker-specified credentials IDs obtained through another method. By exploiting this vulnerability, an attacker can capture credentials stored in Jenkins. Additionally, these form validation methods did not require POST requests, making the plugin vulnerable to Cross-Site Request Forgery (CSRF) attacks. The vulnerability has a CVSS score of 4.2, indicating a moderate severity level.
How To Fix
Latest published version: 1.42.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.42.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the plugin.
Conclusion
The Jenkins GitHub Pull Request Builder Plugin versions 1.41.0 and older are vulnerable to a credential capture vulnerability and CSRF attacks. Upgrading to version 1.42.0 or newer is recommended to fix the vulnerability. It is important to promptly upgrade to the latest version to mitigate the risk of unauthorized access to sensitive information or systems. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ghprb →
FAQ
This vulnerability allows attackers with Overall/Read access to capture credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information or systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can check the vulnerability status of your application without any signup or installation.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to promptly upgrade to the latest version to mitigate the risk.
The recommended solution is to upgrade to the latest version of the plugin. Applying temporary measures may not provide sufficient protection against the vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-92rv-mvmj-47qh/GHSA-92rv-mvmj-47qh.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ghprb.
