EUVD-2026-38765
GHSA-g7c6-wxjf-8564
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jenkins with Overall/Read credentials
-
ExploitSend HTTP request to plugin global config endpoint
-
ExecutionPlugin returns GitHub Enterprise server URLs without authorization check
-
ImpactAttacker records internal GHE hostnames for reconnaissance
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an active, authenticated Jenkins session with at least Overall/Read permission - the lowest standard privilege tier in Jenkins. There is no path to unauthenticated exploitation. The attacker must be able to reach the Jenkins web interface over the network. The vulnerability is only relevant when at least one GitHub Enterprise server URL has been configured in the plugin's global settings; if no GHE servers are configured, no sensitive data is exposed. Exploitation is limited by the requirement for a valid Jenkins account, meaning external threat actors without credentials cannot directly exploit this flaw. The disclosed data is read-only - there is no integrity or availability impact. |
| Impact | The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a low-severity information disclosure requiring network access and a valid Jenkins account. EPSS is 0.21% at the 11th percentile, indicating very low observed exploitation pressure across the broader threat landscape. SSVC corroborates this: exploitation status is none, the vulnerability is not automatable (a human-controlled authenticated session is required), and technical impact is partial. The vulnerability is not listed in CISA KEV. Real-world risk is consequently low: an attacker must already hold valid Jenkins credentials, and the disclosed data - GitHub Enterprise server URLs - is limited in direct utility unless combined with other reconnaissance. However, in environments where GHE server hostnames are considered sensitive (e.g., air-gapped or internal-only instances), exposure of these URLs could aid lateral movement planning. Red Hat is listed as a stakeholder, suggesting potential downstream impact in Red Hat-distributed Jenkins packages. No conflicting signals between data sources were identified. |
| Exploit ScenarioDerived | An internal developer or contractor with a standard Jenkins account (Overall/Read only) sends a crafted HTTP request to the GitHub Branch Source Plugin's global configuration read endpoint. The plugin returns a list of configured GitHub Enterprise server URLs without validating that the user holds administrative privileges. The attacker uses these URLs to map internal GitHub Enterprise infrastructure, informing further targeted attacks against those servers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Information disclosure in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier exposes GitHub Enterprise server URLs to low-privileged users. Any Jenkins user holding the minimal Overall/Read permission can query the global plugin configuration and retrieve the URLs of all configured GitHub Enterprise servers, potentially revealing internal infrastructure topology. No active exploitation has been identified (SSVC: exploitation none; EPSS 0.21%, 11th percentile), and no public exploit code is known at the time of analysis.
RemediationAI
Update the Jenkins GitHub Branch Source Plugin to a version released after 1967.1969.v205fd594c821, as directed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3808. The exact patched release version is not independently confirmed from the provided data - administrators should consult the Jenkins Update Center or the advisory page for the minimum safe version. As a compensating control where immediate update is not feasible, restrict the Overall/Read permission to only fully trusted internal users by tightening Jenkins authorization strategy (e.g., Matrix Authorization Strategy), since Overall/Read is the sole prerequisite for exploitation. Note that removing Overall/Read from all non-admin users may break legitimate user workflows such as viewing job status, so assess the operational trade-off before applying this workaround. Monitoring Jenkins audit logs for unexpected access to global configuration endpoints can provide detection coverage in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Jenkins GitHub Branch Source Plugin, identified by CPE cpe:2.3:a:jenkins_project:jenkins_github_branch_source_plugin:*:*:*:*:*:*:*:*. Jenkins plugins extend the Jenkins CI/CD platform and can expose internal REST or Stapler action endpoints. CWE-862 (Missing Authorization) describes the root cause: the plugin's endpoint for retrieving global GitHub Enterprise server configuration fails to enforce that the calling user holds a sufficient permission (such as Overall/Administer or an explicit read-configuration right), instead permitting any authenticated user with the baseline Overall/Read permission to access the data. This class of flaw is common in Jenkins plugin development when authorization annotations or explicit permission checks are omitted from action handler methods.
Know when Jenkins Github Branch Source Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L reflects mandatory Jenkins authentication (Overall/Read); C:L covers only URL string disclosure with no integrity or availability impact.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
DescriptionCVE.org
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB