Jenkins Git Parameter Plugin CVE-2026-57286

Exploitation requires a valid Jenkins account with at least Item/Read permission on a job that uses the Git Parameter Plugin and is connected to a Git SCM repository - this is the minimum standard read role in Jenkins' authorization matrix. The job itself must be configured with this plugin as a parameter provider; jobs not using Git Parameter Plugin are unaffected. Exploitation is bounded by the need for authenticated credentials (PR:L per CVSS vector), meaning unauthenticated external attackers cannot exploit this without first obtaining a Jenkins account. The impact ceiling is SCM metadata disclosure - no write capability, no code execution, and no availability impact. Jenkins instances that enforce strict Item/Read grants (assigning it only to users who genuinely need to enumerate SCM structure) or that do not expose the Git Parameter Plugin to lower-trust accounts are not realistically at risk.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N yields a 4.3 Medium score, correctly reflecting that exploitation is network-accessible and requires only low-privilege credentials, but impact is limited to partial confidentiality of SCM metadata. EPSS at 0.21% (11th percentile) is consistent with a low-complexity but low-impact finding that has not attracted attacker interest. SSVC independently rates exploitation as none, automatable as no, and technical impact as partial - all converging on a real-but-deprioritized posture. The information disclosed (branch and tag names, revision identifiers) is useful for reconnaissance of CI/CD pipelines and targeted branch-specific attacks but does not directly enable code execution, credential theft, or service disruption. There is no conflict between signals here: CVSS, EPSS, and SSVC all align on a medium-low real-world priority. No public exploit code identified and not listed in CISA KEV.

An authenticated Jenkins user with only Item/Read access on a target job - for example, a developer scoped to a single project - sends a crafted HTTP request to the Git Parameter Plugin's parameter-population endpoint, receiving in the response a full listing of branch names, tag names, and commit revision metadata from the backing Git repository. This metadata could be used to identify unreleased feature branches, security-fix branches, or version tags, enabling more targeted follow-on attacks against the CI/CD pipeline or the upstream repository. No public exploit code exists at time of analysis.