CVE-2019-1003010: Cross-Site Request Forgery in Jenkins Git Plugin
Summary
CVE-2019-1003010: Cross-Site Request Forgery in Jenkins Git Plugin. Affects org.jenkins-ci.plugins:git versions < 3.9.2. Fixed in 3.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Plugin is a Maven package that provides integration between Jenkins and Git repositories. It allows users to configure Jenkins jobs to interact with Git repositories, enabling tasks such as cloning, fetching, and pushing code. The plugin is widely used in software development workflows to automate build and deployment processes.
Vulnerability Detail
A cross-site request forgery vulnerability (CVE-2019-1003010) exists in Jenkins Git Plugin versions 3.9.1 and earlier. The vulnerability is located in the GitTagAction.java file, which is responsible for creating Git tags and attaching metadata to build records. Attackers can exploit this vulnerability to forge requests and create unauthorized Git tags in a workspace, potentially compromising the integrity of the codebase and build process.
How To Fix
Latest published version: 5.11.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Jenkins Git Plugin to the patched version.
Conclusion
The Jenkins Git Plugin is vulnerable to a cross-site request forgery issue that allows unauthorized creation of Git tags and attachment of metadata to build records. To mitigate this vulnerability, it is crucial to update the plugin to version 3.9.2 or later. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git →
FAQ
A cross-site request forgery (CSRF) vulnerability allows an attacker to trick a user into performing unintended actions on a web application in which they are authenticated. In the case of this vulnerability, an attacker can forge requests to create unauthorized Git tags in a Jenkins workspace.
Exploiting this vulnerability can lead to unauthorized Git tags being created in a workspace, potentially compromising the integrity of the codebase and build process. It can also allow an attacker to attach malicious metadata to build records, leading to further security risks.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the fix promptly to mitigate the risk of exploitation.
No, only versions 3.9.1 and earlier of the Jenkins Git Plugin are affected. Users of later versions, such as 3.9.2 and above, are not vulnerable to this specific issue.
To update the Jenkins Git Plugin, navigate to the Jenkins web interface, go to the 'Manage Jenkins' section, select 'Manage Plugins,' and search for 'Git Plugin.' Check the box next to the plugin and click 'Download now and install after restart.' Restart Jenkins to apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git.
