CVE-2022-36882: Lack of authentication mechanism in Jenkins Git Plugin webhook
Summary
CVE-2022-36882: Lack of authentication mechanism in Jenkins Git Plugin webhook. Affects org.jenkins-ci.plugins:git versions < 4.11.4. Fixed in 4.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Plugin provides functionality for integrating Git repositories with Jenkins. It includes a webhook endpoint at /git/notifyCommit that allows Jenkins to be notified of changes to an SCM repository. This endpoint is used to schedule polling for jobs configured with the specified repository. However, versions of Git Plugin up to 4.11.3 do not require authentication for this webhook endpoint, allowing unauthorized access and potential CSRF attacks.
Vulnerability Detail
The lack of authentication mechanism in the Jenkins Git Plugin webhook endpoint allows attackers to exploit this vulnerability by sending GET requests to the /git/notifyCommit endpoint without authentication. This opens up the possibility of cross-site request forgery (CSRF) attacks, where an attacker can trick a user into performing unintended actions on their behalf. This vulnerability has a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
How To Fix
Latest published version: 5.11.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the /git/notifyCommit endpoint or restrict access to it. This can be done by configuring network or firewall rules to block access to the endpoint. However, this workaround should only be considered as a temporary measure, and upgrading to the latest version is strongly recommended.
Conclusion
The lack of authentication in the Jenkins Git Plugin webhook endpoint poses a security risk, allowing unauthorized access and potential CSRF attacks. It is crucial to upgrade to Git Plugin version 4.11.4 or later and configure the webhook token for authentication. Disabling or restricting access to the endpoint can be used as a temporary workaround, but upgrading is strongly recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git →
FAQ
This vulnerability allows attackers to perform CSRF attacks and potentially execute unauthorized actions on behalf of users. It can lead to unauthorized access, data manipulation, and other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
While there is no known public exploit for this vulnerability at the time of this report, it is important to address it promptly to prevent potential attacks.
A temporary workaround is to disable or restrict access to the /git/notifyCommit endpoint. However, this should only be considered as a temporary measure, and upgrading to the latest version is the recommended long-term solution.
You can refer to the official Jenkins Git Plugin documentation at https://github.com/jenkinsci/git-plugin/#push-notification-from-repository for more information about this vulnerability and how to address it.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git.
