CVE-2026-57289
4.8
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.2 / Impact: 2.5
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Description
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
Affected (1)
Products: Jenkins: Bitbucket Push And Pull Request
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 3.3.9 |
References (1)
Source: jenkinsci-cert@googlegroups.com
Vendor Advisory
Timeline
No history available yet.