EUVD-2026-38772
GHSA-wjmq-rpqq-w4h9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint requires only Overall/Read authentication (PR:L); SSRF-like probing yields limited confidentiality and integrity impact with no availability consequence.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
AnalysisAI
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow any authenticated user holding the minimal Overall/Read Jenkins role to trigger outbound connections from the Jenkins controller to an attacker-specified URL using credential IDs sourced through a secondary method. This creates an SSRF-like primitive enabling internal network probing and credential ID validation without administrative access. No public exploit code has been identified at time of analysis, and SSVC confirms current exploitation status as none.
Technical ContextAI
The Jenkins Gitee Plugin integrates Jenkins CI/CD servers with Gitee, a Chinese Git hosting platform. Jenkins plugins commonly expose controller-side HTTP endpoints used to test external service connectivity; these endpoints are intended to be gated behind administrative permissions. In this case, the connection-test endpoint lacks the required authorization check - effectively a CWE-862 (Missing Authorization) pattern, though no CWE is formally assigned in the advisory. Because the endpoint is reachable over the network and requires only the baseline Overall/Read permission, any Jenkins user account can invoke it. The CPE cpe:2.3:a:jenkins_project:jenkins_gitee_plugin:*:*:*:*:*:*:*:* confirms all plugin versions through 1288.v18b_deb_c9069b_ are in scope. The CVSS vector AV:N/AC:L/PR:L/UI:N reflects a straightforward network-reachable call requiring low privilege and no user interaction.
RemediationAI
The primary fix is to upgrade the Jenkins Gitee Plugin to a version beyond 1288.v18b_deb_c9069b_ that incorporates the corrected permission checks, as described in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3762%20(1). An exact fixed version number is not specified in the available data - administrators should consult the Jenkins plugin update center for the latest available release and apply it promptly. If immediate patching is not feasible, restrict the Overall/Read permission to only fully trusted internal users, since exploitation requires that privilege level; note that tightening this permission may affect other plugin and view access across the Jenkins instance. Additionally, applying network egress controls on the Jenkins controller to limit outbound connections to known-good Gitee endpoints reduces the SSRF attack surface without requiring a plugin change. Administrators should also audit which credential IDs are accessible to low-privilege accounts and rotate any that may have been enumerated.
More in Jenkins Gitee Plugin
View allCross-site request forgery in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows network-accessible attackers
Credential ID enumeration in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows authenticated attackers holdi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today