Executive brief
The Jenkins GitHub Branch Source Plugin, which allows Jenkins to automate builds based on GitHub activity, contains a security flaw that exposes internal server addresses. An authorized user with basic access to the Jenkins dashboard can view the web addresses (URLs) of private GitHub Enterprise servers used by the organization. While this does not expose source code or passwords, it reveals internal infrastructure details that could be used to plan further targeted attacks.
Technical details
A missing permission check exists in an HTTP endpoint within the Jenkins GitHub Branch Source Plugin (versions 1967.1969.v205fd594c821 and earlier). This endpoint is responsible for listing GitHub API endpoints configured in the global plugin settings. An attacker with 'Overall/Read' permissions can query this endpoint to enumerate the URLs of GitHub Enterprise servers configured by administrators. The vulnerability was addressed in version 1967.1970.vd86979736546, which now requires 'Overall/Manage' or 'Item/Extended Read' permissions to access this data.
Affected products
- Jenkins Project GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
- 2026-06-24: patched