Executive brief
The Jenkins GitHub Integration Plugin, which automates build processes for GitHub repositories, contains a security flaw that could allow an attacker to trick a user into unintentionally triggering a software build. By exploiting this vulnerability, an unauthorized party could initiate builds for pull requests without proper authorization, potentially disrupting development workflows or consuming computing resources.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins GitHub Integration Plugin versions 0.7.3 and earlier. The root cause is the failure of an HTTP endpoint to enforce POST requests, allowing state-changing actions to be triggered via GET requests. An unauthenticated remote attacker can exploit this by inducing a logged-in Jenkins user to visit a malicious URL or web page. Successful exploitation allows the attacker to trigger a build for a pull request. The issue is resolved in version 0.7.4, which mandates POST requests for the affected endpoint.
Affected products
- Jenkins Project GitHub Integration Plugin <= 0.7.3
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched: Fixed in version 0.7.4