CVE-2026-57285 Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Attackers with read access can view configured GitHub Enterprise server URLs due to missing permission checks in the Jenkins plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57285?
CVE-2026-57285 is a medium-severity missing authorization vulnerability in Jenkins GitHub Branch Source Plugin, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
Weakness: CWE-862
Which versions are affected by CVE-2026-57285?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:github-branch-source. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:github-branch-source Maven | All versions | 1967.1970 |
org.jenkins-ci.plugins:github-branch-source Maven | All versions | 1967.1970 |
Products include Jenkins Github Branch Source.
How do I fix CVE-2026-57285?
Upgrade org.jenkins-ci.plugins:github-branch-source to 1967.1970 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57285 being exploited?
There is no known exploitation of CVE-2026-57285 in the wild and no public exploit code.
Other vulnerabilities in Jenkins GitHub Branch Source Plugin
- CVE-2024-23901 Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin
- CVE-2017-1000091 Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery
- CVE-2024-23903 Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin
- CVE-2026-42522 Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test
- CVE-2024-23902 CSRF vulnerability in Jenkins GitLab Branch Source Plugin
Sources
Also known as GHSA-g7c6-wxjf-8564.