CVE-2026-57286: Jenkins Git Parameter Plugin Missing Permission Check Allows Unauthorized SCM Information Access
Summary
CVE-2026-57286: Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier does not perform a permission check in an HTTP endpoint that populates the list of values for Git parameters by querying the SCM configured on a job, using the... Affects org.jenkins-ci.tools:git-parameter versions < 462.463. Fixed in 462.463. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Parameter Plugin is a widely used tool that allows Jenkins users to dynamically populate parameter values for jobs based on Git branches and tags. This plugin enhances the flexibility of Jenkins jobs by enabling users to select from available branches and tags in their Git repositories. However, a critical vulnerability has been identified in versions up to 462.vdcf3df2ed2ca_, where the plugin fails to enforce proper permission checks, potentially exposing sensitive SCM information.
Vulnerability Detail
The vulnerability arises from a missing permission check in an HTTP endpoint that retrieves SCM branch and tag names for Git parameters. Attackers with Item/Read permission can exploit this flaw to gain unauthorized access to sensitive information about the SCM repository, including branch names, tag names, and revision metadata. This could lead to information disclosure and unauthorized insights into the repository's structure and history, impacting the security posture of the affected Jenkins instance.
How To Fix
Minimum fixed version
462.463
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Jenkins job configurations to ensure that only authorized users have Item/Read permissions. This can help mitigate the risk until the plugin is updated.
Conclusion
The Jenkins Git Parameter Plugin vulnerability (CVE-2026-57286) poses a significant risk by allowing unauthorized access to sensitive SCM information due to a missing permission check. It is crucial for users to update to the patched version (462.463) to mitigate this risk and ensure the security of their Jenkins instances.
See every vulnerability recorded for org.jenkins-ci.tools:git-parameter →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Versions up to 462.vdcf3df2ed2ca_ are affected by this vulnerability.
Attackers can access sensitive information such as branch names, tag names, and revision metadata from the SCM repository.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker needs Item/Read permission to exploit this vulnerability and access unauthorized SCM information.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.tools:git-parameter.
