EUVD-2026-38770
GHSA-jwhr-h7pc-3974
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network vector because Jenkins contacts Bitbucket over HTTPS; AC:H for required MitM positioning; PR:N as attacker needs no credentials; C:L/I:L for token capture and potential request manipulation; no availability impact.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
AnalysisAI
Jenkins Bitbucket Push and Pull Request Plugin versions 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for all outbound Bearer token authenticated requests to configured Bitbucket Server endpoints, creating a man-in-the-middle exposure. Any attacker positioned to intercept network traffic on the path between the Jenkins controller and the Bitbucket Server can capture the Bearer token and subsequently authenticate directly to the Bitbucket Server API. No public exploit is identified at time of analysis, and SSVC rates exploitation as none with partial technical impact; however, the token capture risk is non-trivial for deployments routing Jenkins traffic over untrusted or shared network segments.
Technical ContextAI
The affected component is the Jenkins Bitbucket Push and Pull Request Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_bitbucket_push_and_pull_request_plugin:*:*:*:*:*:*:*:*), a Jenkins CI/CD integration plugin for Bitbucket Server webhook and pull request event handling. The root cause is CWE-295 (Improper Certificate Validation): the plugin unconditionally disables both X.509 certificate chain validation and TLS hostname verification when establishing HTTPS connections to the user-configured Bitbucket Server endpoint, specifically for requests carrying Bearer token credentials. This degrades the connection from mutually-authenticated TLS to an encrypted-but-unauthenticated channel, meaning any entity capable of presenting any certificate for that hostname - including a self-signed or attacker-controlled certificate - can successfully intercept and read the plaintext Bearer token embedded in the HTTP Authorization header.
RemediationAI
Administrators should consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3856 to identify the patched plugin release and upgrade immediately via the Jenkins Plugin Manager (Manage Jenkins → Plugins → Available updates). The exact fixed version number is not confirmed in the available input data and should be obtained directly from the advisory. If an immediate upgrade is not feasible, a compensating control is to restrict all network paths between the Jenkins controller and the Bitbucket Server to a private, trusted network segment (e.g., dedicated VLAN, VPN tunnel) where third-party interception is infeasible; note this does not remediate the underlying certificate validation bypass but eliminates attacker positioning opportunity. Additionally, after upgrading, rotating the Bearer tokens used by the plugin is advisable, as tokens may have been intercepted prior to patching and could remain usable until revoked on the Bitbucket Server side.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today