CVE-2018-1000185: Jenkins GitHub Branch Source Plugin Server-Side Request Forgery
Summary
CVE-2018-1000185: Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery. Affects org.jenkins-ci.plugins:github-branch-source versions < 2.3.5. Fixed in 2.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Branch Source Plugin is a Maven package that provides functionality for integrating GitHub repositories as sources for Jenkins pipelines. It allows users to define and manage Jenkins jobs based on branches, pull requests, and tags in GitHub repositories. This plugin is widely used in continuous integration and delivery workflows to automate the building, testing, and deployment of software projects.
Vulnerability Detail
A server-side request forgery (SSRF) vulnerability has been identified in the Jenkins GitHub Branch Source Plugin version 2.3.4 and older. The vulnerability resides in the Endpoint.java file and can be exploited by attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, the form validation method used in the plugin did not require POST requests, making it susceptible to cross-site request forgery (CSRF) attacks. The vulnerability has been assigned a CVSS score of 4.3, indicating a moderate severity level. Exploitation of this vulnerability could lead to unauthorized access to internal resources, information disclosure, or further attacks on the Jenkins server.
How To Fix
Latest published version: 1986.v801e40614d00 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, users can apply a workaround by restricting access to the Jenkins server and ensuring that only trusted users have Overall/Read permissions. Additionally, it is recommended to implement network-level controls, such as firewalls or security groups, to restrict outgoing requests from the Jenkins server to external URLs.
Conclusion
The Jenkins GitHub Branch Source Plugin version 2.3.4 and older are vulnerable to a server-side request forgery (SSRF) vulnerability that can be exploited by attackers with Overall/Read access. Upgrading to version 2.3.5 or newer is recommended to mitigate this vulnerability. Users can also apply the provided workaround to restrict access and implement network-level controls. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:github-branch-source →
FAQ
The vulnerability allows attackers with Overall/Read access to trigger arbitrary GET requests from the Jenkins server, potentially leading to unauthorized access to internal resources or information disclosure.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read access to the Jenkins server.
There are no known instances of this vulnerability being exploited in the wild at this time.
Yes, a fix for this vulnerability is available in version 2.3.5 of the Jenkins GitHub Branch Source Plugin.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:github-branch-source.
