# CVE-2026-57285: Jenkins GitHub Branch Source Plugin missing permission check in API endpoint

Source: https://junglewise.ai/threats/cve-2026-57285-jenkins-github-branch-source-plugin-missing-permission-check-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-57285 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins GitHub Branch Source Plugin, which allows Jenkins to automate builds based on GitHub activity, contains a security flaw that exposes internal server addresses. An authorized user with basic access to the Jenkins dashboard can view the web addresses (URLs) of private GitHub Enterprise servers used by the organization. While this does not expose source code or passwords, it reveals internal infrastructure details that could be used to plan further targeted attacks.

Technologies: [org.jenkins-ci.plugins:github-branch-source (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-github-branch-source). Vendors: [Jenkins Project](https://junglewise.ai/threats/vendors/jenkins-project), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-57285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57285 being exploited in the wild.

**How severe is CVE-2026-57285?** Medium severity, with a CVSS score of 4.3, published 24 June 2026.

**Which products and versions are affected?** Jenkins Project GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier; org.jenkins-ci.plugins:github-branch-source (Maven) < 1967.1970, ECOSYSTEM:introduced=0,fixed=1967.1970.

**Is there a fix for CVE-2026-57285?** Yes. org.jenkins-ci.plugins:github-branch-source (Maven): upgrade to 1967.1970 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57285 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57285?** Check whether you run Jenkins Project GitHub Branch Source Plugin or org.jenkins-ci.plugins:github-branch-source (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:github-branch-source (Maven): upgrade to 1967.1970 or later

  ```sh
  # set org.jenkins-ci.plugins:github-branch-source to 1967.1970 in your pom.xml or build.gradle
  ```


## Technical details

A missing permission check exists in an HTTP endpoint within the Jenkins GitHub Branch Source Plugin (versions 1967.1969.v205fd594c821 and earlier). This endpoint is responsible for listing GitHub API endpoints configured in the global plugin settings. An attacker with 'Overall/Read' permissions can query this endpoint to enumerate the URLs of GitHub Enterprise servers configured by administrators. The vulnerability was addressed in version 1967.1970.vd86979736546, which now requires 'Overall/Manage' or 'Item/Extended Read' permissions to access this data.

## Affected products

- Jenkins Project GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier

## Identifiers

- CVE-2026-57285
- GHSA-g7c6-wxjf-8564

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: advisory
- 2026-06-24: patched

## References

- [https://www.jenkins.io/security/advisory/2026-06-24/](https://www.jenkins.io/security/advisory/2026-06-24/)

## Related threats

- [Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test](https://junglewise.ai/threats/cve-2026-42522-jenkins-github-branch-source-plugin-missing-permissions-check)
- [Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2017-1000091-jenkins-github-branch-source-plugin-vulnerable-to-cross-site)
- [Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs](https://junglewise.ai/threats/cve-2017-1000087-jenkins-github-branch-source-plugin-allows-any-user-with)
- [Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery](https://junglewise.ai/threats/cve-2018-1000185-jenkins-github-branch-source-plugin-vulnerable-to-server-side)