Medium severity4.3NVD Advisory· Published Apr 29, 2026· Updated May 6, 2026
CVE-2026-42522
CVE-2026-42522
Description
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:github-branch-sourceMaven | < 1967.1969.v205fd594c821 | 1967.1969.v205fd594c821 |
Affected products
2- cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:*Range: <=1967.vdea_d580c1a_b_a
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-wg26-8wmj-cf9pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42522ghsaADVISORY
- www.jenkins.io/security/advisory/2026-04-29/nvdVendor AdvisoryWEB
News mentions
1- Jenkins Security Advisory 2026-04-29Jenkins Security Advisories · Apr 29, 2026