What is the CVSS score of CVE-2026-48925?

CVE-2026-48925 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48925?

Yes, a patch is available for CVE-2026-48925. Update the affected software to the latest version immediately.

GitHub Integration Plugin CVE-2026-48925

EUVD-2026-32516 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-rf8w-7c3g-7h3g

CSRF Jenkins

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:12 vuln.today

DescriptionCVE.org

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

AnalysisAI

Cross-site request forgery in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows unauthenticated remote attackers to trigger unauthorized pull request builds by tricking an authenticated Jenkins user into visiting a crafted page. The vulnerability stems from missing CSRF token validation on the endpoint that triggers pull request builds. With CVSS 4.3 (Medium) and no public exploit or KEV listing identified at time of analysis, this represents a moderate-integrity risk primarily in CI/CD pipeline environments where unauthorized build execution could be leveraged for resource abuse or workflow manipulation.

Technical ContextAI

Jenkins GitHub Integration Plugin provides webhook and pull request build triggering functionality between GitHub repositories and Jenkins CI/CD servers. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the plugin's build-trigger endpoint lacks anti-CSRF token validation, meaning any HTTP request originating from a victim's authenticated browser session - regardless of origin - will be accepted and executed. The CVSS vector AV:N/AC:L/PR:N/UI:R confirms the network-accessible, low-complexity, no-privilege attack path requiring only that a logged-in Jenkins user interact with attacker-controlled content. Affected versions are Jenkins GitHub Integration Plugin 0.x through and including 0.7.3 (EUVD-2026-32516).

RemediationAI

The primary fix is to upgrade the Jenkins GitHub Integration Plugin to the version released by the Jenkins project in the security advisory published 2026-05-27 at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3776 - an exact fixed version number is not independently confirmed from the input data beyond the advisory reference, so consult that page directly for the patched release. Patch available per vendor advisory. As a compensating control while patching, administrators can restrict access to the Jenkins instance to trusted internal networks or VPN, reducing the exposure window for CSRF attacks that require a victim's browser to reach attacker-controlled content while also being authenticated to Jenkins. Additionally, enforcing strict Content Security Policy headers and ensuring Jenkins' built-in CSRF protection (crumb issuer) is enabled for all other endpoints limits lateral CSRF risk. Note that network restriction does not eliminate CSRF risk if users browse external content from within the trusted network.