Every CVE Search/ Get API key

CVE-2026-57285

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

4.3 MediumFix available

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.28%Up 0.1 points since Jun 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

Record
CVE-2026-57285
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02
EUVDEUVD-2026-38765 4.3

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

Record
EUVD-2026-38765
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g7c6-wxjf-8564 4.3

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier does not perform a permission check in an HTTP endpoint that lists the GitHub API endpoints configured in the global plugin configuration.

This allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured by administrators.

This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. GitHub Branch Source Plugin 1967.1970.vd86979736546 requires Overall/Manage permission or Item/Extended Read permission on an item to list the configured GitHub API endpoints.

Record
GHSA-g7c6-wxjf-8564
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02
NVD 4.3

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

Record
CVE-2026-57285
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02
OSV 4.3

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

Record
CVE-2026-57285
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-g7c6-wxjf-8564 4.3

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier does not perform a permission check in an HTTP endpoint that lists the GitHub API endpoints configured in the global plugin configuration.

This allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured by administrators.

This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. GitHub Branch Source Plugin 1967.1970.vd86979736546 requires Overall/Manage permission or Item/Extended Read permission on an item to list the configured GitHub API endpoints.

Record
GHSA-g7c6-wxjf-8564
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:github-branch-source
Maven
 before 1967.1970
1967.1970
org.jenkins-ci.plugins:github-branch-source
Maven
 before 1967.1970, plus listed versions
0.1-beta-10.1-beta-20.1-beta-30.1-beta-41.0
Show 45 moreShow less
1.11.101.10.11.21.31.41.4-beta-11.51.61.71.81.8.11.91577.v83564088883f1583.v18d333ef73791598.v91207e9f9b_4a_1599.v9fb_798a_a_7c4f1602.vfe89fe441b_361619.v962f131fa_c151628.vb_2f51293cb_781637.vd833b_7ca_76541656.v77eddb_b_e95df1677.v731f745ea_0cf1687.v7618247e672d1694.vd46793a_c4a_571695.v88de84e9f6b_91696.v3a_7603564d041701.v00cc8184df931703.vd5a_2b_29c6cdc1725.vd391eef681a_e1728.v859147241f491730.vff97c8a_1f8041732.v3f1889a_c475b_1734.v8a_ed3a_6534901740.v51d5810e9e8c1741.va_3028eb_9fd211748.v6b_61a_1dc35b_41750.v6b_fb_8df8f9851751.v90e17c48a_6a_c1752.vc201a_0235d801755.vcdb_d136f3b_251758.v048414714f5d1767.va_7d01ea_c72561771.v59b_6a_fa_1b_89e1772.va_69eda_d018d4
1967.1970

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57285 is a medium vulnerability (CVSS 4.3) in Jenkins Github Branch Source, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in org.jenkins-ci.plugins:github-branch-source 1967.1970.

References

This page doesn't list everything

Left out here: 113 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open