Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

MEDIUM 4.3CVE-2026-42522 · GHSA-wg26-8wmj-cf9p · Published 29/04/2026 · updated 26/10/2026

In short

CVE-2026-42522 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:github-branch-source, github branch source (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.18%, higher than 8.0% of all vulnerabilities.
Fix: update to 1967.1969.v205fd594c821 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:github-branch-source Maven	`< 1967.1969.v205fd594c821`	`1967.1969.v205fd594c821`
github branch source jenkins	`≤ 1967.vdea_d580c1a_b_a`	No fix yet

Description

Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier do not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.

GitHub Branch Source Plugin 1967.1969.v205fd594c821 requires Overall/Manage permission to perform the connection test.

NVD description

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.

References

nvd.nist.gov/vuln/detail/CVE-2026-42522 · ADVISORY
jenkins.io/security/advisory/2026-04-29 · WEB

More vulnerabilities in org.jenkins-ci.plugins:github-branch-source

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:github-branch-source

Maven

< 1967.1969.v205fd594c821

1967.1969.v205fd594c821

github branch source

jenkins

≤ 1967.vdea_d580c1a_b_a

No fix yet

Description

Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier do not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.

GitHub Branch Source Plugin 1967.1969.v205fd594c821 requires Overall/Manage permission to perform the connection test.

NVD description

More vulnerabilities in org.jenkins-ci.plugins:github-branch-source

See all →