CVE-2026-57286

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

4.3 MediumFix available

A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.28%Up 0.1 points since Jun 25, 2026

What each source reports

CVE List Score used 4.3

Record: CVE-2026-57286
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-38766 4.3

Record: EUVD-2026-38766
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hwvp-7xqv-8jx3 4.3

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier does not perform a permission check in an HTTP endpoint that populates the list of values for Git parameters by querying the SCM configured on a job, using the SCM credentials configured in Jenkins.

This allows attackers with Item/Read permission to obtain information about the SCM repository used by a job they would otherwise be unable to access, such as branch names, tag names, and revision metadata.

Git Parameter Plugin 462.463.v496a_59f698e5 requires Item/Build permission to populate the list of values for Git parameters.

Record: GHSA-hwvp-7xqv-8jx3
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 4.3

Record: CVE-2026-57286
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 4.3

Record: CVE-2026-57286
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVGHSA-hwvp-7xqv-8jx3 4.3

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

Git Parameter Plugin 462.463.v496a_59f698e5 requires Item/Build permission to populate the list of values for Git parameters.

Record: GHSA-hwvp-7xqv-8jx3
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.tools:git-parameter` Maven	before 462.463	462.463
`org.jenkins-ci.tools:git-parameter` Maven	before 462.463, plus listed versions 0.10.00.11.00.4.00.5.00.5.1 Show 33 moreShow less 0.6.00.6.10.6.20.7.00.7.10.7.20.8.00.8.10.9.00.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.9435.va_f85861c663a_439.vb_0e46ca_14534444.vca_b_84d3703c2460.v71e7583a_c099462.vdcf3df2ed2ca_	462.463

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57286 is a medium vulnerability (CVSS 4.3) in Jenkins Git Parameter, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in org.jenkins-ci.tools:git-parameter 462.463.