Jenkins GitHub Branch Source Plugin CVE-2026-42522

Exploitation requires a Jenkins instance with the GitHub Branch Source Plugin version 1967.vdea_d580c1a_b_a_ or earlier installed and active. The attacker must possess a valid Jenkins user account with Overall/Read permission - the baseline permission level granted to nearly all authenticated Jenkins users by default. No additional configuration, elevated role, or special feature flag is required beyond plugin installation. Exploitation is bounded by the need for a valid Jenkins credential: unauthenticated external attackers cannot exploit this directly. Risk is further limited in environments where Jenkins is not internet-accessible, where Overall/Read is restricted to a small set of known-trusted users, or where outbound network egress from the Jenkins host is controlled.

The vendor CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects a limited integrity impact with no confidentiality or availability consequence in isolation. The PR:L requirement is the primary limiting factor: an attacker must already hold a valid Jenkins account with Overall/Read permission, which excludes unauthenticated external attackers. EPSS at 0.03% (7th percentile) is exceptionally low, and SSVC rates exploitation as 'none' with only partial technical impact and no automatable exploitation path. These signals converge on low urgency for most organizations. However, raw CVSS understates one real-world concern: the ability to make Jenkins initiate authenticated outbound requests to arbitrary infrastructure is an SSRF-class primitive that, in sensitive CI/CD environments handling production secrets, can enable internal network reconnaissance or serve as a stepping stone in a broader attack chain. Environments where Jenkins is internet-facing or where Overall/Read is granted broadly should treat this with higher priority than the score alone implies.

An attacker holding a low-privilege Jenkins account submits a crafted request to the vulnerable GitHub Branch Source Plugin endpoint, specifying an attacker-controlled URL and arbitrary GitHub App credentials as parameters. Jenkins processes the request without verifying that the caller has the authorization to perform this operation, and the server initiates an outbound HTTP connection to the attacker's infrastructure. The attacker's server logs the request origin, headers, and any credential material transmitted, enabling network reconnaissance of the Jenkins host's egress path. No public proof-of-concept code has been identified at the time of analysis.