What is the CVSS score of CVE-2026-57286?

CVE-2026-57286 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Jenkins Git Parameter Plugin CVE-2026-57286

EUVD-2026-38766 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 jenkins

GHSA-hwvp-7xqv-8jx3

Jenkins Authentication Bypass Jenkins Git Parameter Plugin

4.3

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Jenkins is network-exposed (AV:N), Item/Read is a low privilege role (PR:L), and only SCM metadata is disclosed with no integrity or availability impact (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:00 vuln.today

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.

AnalysisAI

Missing authorization in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier exposes SCM repository metadata - branch names, tag names, and revision data - to any Jenkins user holding only Item/Read permission. An authenticated low-privilege user can query this metadata from jobs they can read without possessing the additional permissions that should gate SCM enumeration. No active exploitation has been confirmed, EPSS probability is minimal at 0.21% (11th percentile), and SSVC rates exploitation as none - making this a low-priority information disclosure issue for most organizations.

Technical ContextAI

The Jenkins Git Parameter Plugin extends Jenkins' parameterized build framework to allow dynamic selection of Git branches, tags, or commit revisions as job parameters. The root cause is CWE-862 (Missing Authorization): a plugin endpoint or internal function returns SCM repository metadata without verifying that the requesting principal holds any permission beyond the base Item/Read role. Jenkins' permission model grants Item/Read as the minimum access level for viewing a job's existence and configuration; a properly implemented check would require an additional permission (such as Item/Configure or a plugin-specific capability) before exposing repository structure. The CPE cpe:2.3:a:jenkins_project:jenkins_git_parameter_plugin:*:*:*:*:*:*:*:* covers all versions up to and including 462.vdcf3df2ed2ca_, indicating no prior version is safe.

RemediationAI

Update the Jenkins Git Parameter Plugin to the version published after 462.vdcf3df2ed2ca_ as documented in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3745 - the precise patched version number is not available in current input data and must be confirmed directly from that advisory before deployment. As a compensating control prior to patching, restrict Item/Read permission on Jenkins jobs backed by sensitive Git repositories to only explicitly trusted users or service accounts; this directly limits the population of principals who can trigger the missing-check code path. Be aware that over-restricting Item/Read may break legitimate use cases such as read-only dashboards or build status monitors. If Jenkins uses Role-Based Access Control, audit the matrix for accounts that hold Item/Read on sensitive pipeline jobs but should not have visibility into repository structure.