GitHub Integration Plugin CVE-2026-48925

Exploitation requires that the victim be authenticated to the Jenkins instance with sufficient permissions to trigger pull request builds at the time they visit the attacker-controlled page. The Jenkins GitHub Integration Plugin must be installed and active (version 0.7.3 or earlier). The attacker has no required authentication themselves (PR:N), but must successfully deliver a crafted link or page to an authenticated Jenkins user (UI:R). Exploitation is limited by: mandatory user interaction with attacker-controlled content, the victim needing an active authenticated session, and the impact being restricted to triggering builds rather than gaining code execution, credential access, or persistent foothold directly from this vulnerability alone.

The CVSS score of 4.3 (Medium) accurately reflects the constrained impact profile: integrity is minimally affected (I:L), with no confidentiality or availability impact (C:N/A:N), and scope is unchanged (S:U). The UI:R component is the primary limiting factor - exploitation requires social engineering an authenticated Jenkins user, reducing opportunistic attack viability. EPSS data is not provided; given the absence of KEV listing and no public exploit identified at time of analysis, mass exploitation is unlikely. The real-world risk is elevated in organizations where Jenkins builds trigger downstream deployments or consume significant compute/cost resources, as unauthorized build triggering could abuse those pipelines. In isolated or internally-accessible Jenkins deployments with limited external exposure, actual risk is low. No conflicting signals exist between available data sources.

An attacker hosts a malicious webpage containing a hidden form or image tag that submits a forged HTTP request to the target Jenkins instance's pull request build-trigger endpoint. When an authenticated Jenkins user visits the page - via phishing email or compromised link - the victim's browser automatically sends the request with their session credentials, causing Jenkins to initiate a build for an attacker-specified pull request without the user's knowledge. No public exploit code has been identified at time of analysis, but the attack technique is well-documented for CWE-352 and requires no specialized tooling.