EUVD-2026-32516
GHSA-rf8w-7c3g-7h3g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.
AnalysisAI
Cross-site request forgery in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows unauthenticated remote attackers to trigger unauthorized pull request builds by tricking an authenticated Jenkins user into visiting a crafted page. The vulnerability stems from missing CSRF token validation on the endpoint that triggers pull request builds. With CVSS 4.3 (Medium) and no public exploit or KEV listing identified at time of analysis, this represents a moderate-integrity risk primarily in CI/CD pipeline environments where unauthorized build execution could be leveraged for resource abuse or workflow manipulation.
Technical ContextAI
Jenkins GitHub Integration Plugin provides webhook and pull request build triggering functionality between GitHub repositories and Jenkins CI/CD servers. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the plugin's build-trigger endpoint lacks anti-CSRF token validation, meaning any HTTP request originating from a victim's authenticated browser session - regardless of origin - will be accepted and executed. The CVSS vector AV:N/AC:L/PR:N/UI:R confirms the network-accessible, low-complexity, no-privilege attack path requiring only that a logged-in Jenkins user interact with attacker-controlled content. Affected versions are Jenkins GitHub Integration Plugin 0.x through and including 0.7.3 (EUVD-2026-32516).
RemediationAI
The primary fix is to upgrade the Jenkins GitHub Integration Plugin to the version released by the Jenkins project in the security advisory published 2026-05-27 at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3776 - an exact fixed version number is not independently confirmed from the input data beyond the advisory reference, so consult that page directly for the patched release. Patch available per vendor advisory. As a compensating control while patching, administrators can restrict access to the Jenkins instance to trusted internal networks or VPN, reducing the exposure window for CSRF attacks that require a victim's browser to reach attacker-controlled content while also being authenticated to Jenkins. Additionally, enforcing strict Content Security Policy headers and ensuring Jenkins' built-in CSRF protection (crumb issuer) is enabled for all other endpoints limits lateral CSRF risk. Note that network restriction does not eliminate CSRF risk if users browse external content from within the trusted network.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today