EUVD-2026-26224Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible endpoint, no complexity; PR:L required since Overall/Read account is mandatory; C:N because attacker supplies their own credentials, not exfiltrating Jenkins secrets.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.
AnalysisAI
Missing authorization (CWE-862) in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows any authenticated user with only Overall/Read permission to force the Jenkins server to initiate outbound connections to an arbitrary attacker-controlled URL using attacker-supplied GitHub App credentials. This SSRF-adjacent capability enables abuse of Jenkins as an unauthorized network proxy and may expose internal network topology to external actors. No public exploit has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (7th percentile) and SSVC exploitation status of 'none' confirm low near-term exploitation likelihood, though the low privilege barrier makes it accessible to any credentialed Jenkins user.
Technical ContextAI
The Jenkins GitHub Branch Source Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_github_branch_source_plugin) provides multibranch pipeline and GitHub organization folder support by integrating GitHub App authentication into Jenkins pipelines. CWE-862 (Missing Authorization) identifies the root cause: a code path that initiates external connections to validate or use GitHub App credentials simply omits the required permission gate, meaning the enforcement logic was never implemented rather than being bypassed. Normally, operations that make outbound authenticated network connections on behalf of the server should require elevated permissions (e.g., Overall/Administer), not the baseline Overall/Read role available to nearly all Jenkins users. The flaw is confined to the plugin itself - Jenkins core is not implicated per the CPE string.
RemediationAI
A vendor-released patch is available per the Jenkins security advisory published 2026-04-29 at https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3702. The exact fixed plugin version must be confirmed from that advisory or the Jenkins update center, as the available input data does not specify a precise patched release number. Administrators should update the GitHub Branch Source Plugin via the Jenkins plugin manager immediately. As a compensating control prior to patching, audit and restrict Overall/Read permission to only explicitly trusted user accounts, since any holder of that permission can trigger the vulnerable code path. Additionally, deploying egress network controls that limit Jenkins outbound connections to known GitHub API endpoints (api.github.com) will constrain the SSRF impact radius and is advisable as a defense-in-depth measure regardless of patch status. Note that restricting Overall/Read broadly may affect other Jenkins functionality that legitimate users rely on - evaluate scope before applying.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today