Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

MEDIO 4.3CVE-2026-48925 · GHSA-rf8w-7c3g-7h3g · Published 27/05/2026 · updated 14/10/2026

In breve

CVE-2026-48925 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda org.jenkins-ci.plugins:github-integration-parent, github integration (kostyasha).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.10%, superiore al 1.1% delle vulnerabilità.
Correzione: aggiornare a 0.7.4 o successiva.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:github-integration-parent Maven	`< 0.7.4`	`0.7.4`
github integration kostyasha	`< 0.7.4`	`0.7.4`

Description

Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to trigger a build for a pull request.

GitHub Integration Plugin 0.7.4 requires POST requests for the affected HTTP endpoint.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

References

nvd.nist.gov/vuln/detail/CVE-2026-48925 · ADVISORY
KostyaSha/github-integration-plugin · PACKAGE
jenkins.io/security/advisory/2026-05-27 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free