Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

MEDIUM 4.3CVE-2026-48925 · GHSA-rf8w-7c3g-7h3g · Published 27/05/2026 · updated 14/10/2026

In short

CVE-2026-48925 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:github-integration-parent, github integration (kostyasha).
Chance of exploitation in the next 30 days (EPSS): 0.10%, higher than 1.1% of all vulnerabilities.
Fix: update to 0.7.4 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:github-integration-parent Maven	`< 0.7.4`	`0.7.4`
github integration kostyasha	`< 0.7.4`	`0.7.4`

Description

Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to trigger a build for a pull request.

GitHub Integration Plugin 0.7.4 requires POST requests for the affected HTTP endpoint.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

References

nvd.nist.gov/vuln/detail/CVE-2026-48925 · ADVISORY
KostyaSha/github-integration-plugin · PACKAGE
jenkins.io/security/advisory/2026-05-27 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free