Medium severity4.3NVD Advisory· Published Jun 24, 2026· Updated Jun 26, 2026
CVE-2026-57285
CVE-2026-57285
Description
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:github-branch-sourceMaven | < 1967.1970 | 1967.1970 |
Affected products
2cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:*+ 1 more
- cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:*range: <=1967.1969.v205fd594c821
- (no CPE)range: <=1967.1969.v205fd594c821
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-g7c6-wxjf-8564ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-57285ghsaADVISORY
- www.jenkins.io/security/advisory/2026-06-24/nvdVendor AdvisoryWEB
- github.com/jenkinsci/github-branch-source-plugin/commit/d869797365462234fe061c74fe6bf0bcae8777eaghsaWEB
- github.com/jenkinsci/github-branch-source-plugin/releases/tag/1967.1970.vd86979736546ghsaWEB
News mentions
2- Jenkins Project: 25 Plugin Vulnerabilities Disclosed Together on June 24, 2026Vypr Intelligence · Jun 24, 2026
- Jenkins Security Advisory 2026-06-24Jenkins Security Advisories · Jun 24, 2026