CVE-2026-57285: Jenkins GitHub Branch Source Plugin Missing Permission Check Vulnerability
Summary
CVE-2026-57285: Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier does not perform a permission check in an HTTP endpoint that lists the GitHub API endpoints configured in the global plugin configuration. Affects org.jenkins-ci.plugins:github-branch-source versions < 1967.1970. Fixed in 1967.1970. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Branch Source Plugin is a widely used tool that integrates GitHub repositories with Jenkins, enabling automated builds and deployments. It allows users to manage GitHub branches and pull requests directly from Jenkins. However, a critical vulnerability has been identified in versions 1967.1969.v205fd594c821 and earlier, where the plugin fails to enforce proper permission checks, potentially exposing sensitive information.
Vulnerability Detail
The Jenkins GitHub Branch Source Plugin lacks a necessary permission check in an HTTP endpoint that lists the GitHub API endpoints configured in the global plugin settings. This oversight allows attackers with Overall/Read permission to enumerate the URLs of GitHub Enterprise servers set up by administrators. If exploited, this vulnerability could lead to unauthorized access to sensitive server configurations, posing a risk to the security of the Jenkins environment.
How To Fix
Latest published version: 1986.v801e40614d00 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1967.1970
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Jenkins instance to trusted users only, ensuring that only those with the necessary permissions can access the plugin's configuration settings.
Conclusion
The Jenkins GitHub Branch Source Plugin vulnerability (CVE-2026-57285) poses a significant risk due to missing permission checks, allowing unauthorized users to access sensitive GitHub Enterprise server URLs. It is crucial to update to the latest version to mitigate this risk and ensure the security of your Jenkins environment.
See every vulnerability recorded for org.jenkins-ci.plugins:github-branch-source →
FAQ
CVE-2026-57285 is a vulnerability in the Jenkins GitHub Branch Source Plugin that allows unauthorized users to enumerate GitHub Enterprise server URLs due to missing permission checks.
Versions 1967.1969.v205fd594c821 and earlier of the Jenkins GitHub Branch Source Plugin are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground at Vulert Scanner, you can check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If immediate updates are not possible, consider restricting access to your Jenkins instance to limit exposure to the vulnerability until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:github-branch-source.
