Executive brief
The Jenkins Git Parameter Plugin, which allows users to select git branches or tags when starting a build, contains a security flaw. This vulnerability allows users who only have permission to view a job to also see sensitive metadata from the underlying source code repository, such as branch names, tags, and revision history. This could lead to the exposure of internal development details or project structure that should otherwise be restricted.
Technical details
The Git Parameter Plugin fails to perform an adequate permission check on an HTTP endpoint used to populate Git parameter values. By querying this endpoint, an attacker with Item/Read permission can trigger the plugin to fetch data from the configured SCM repository using Jenkins' stored credentials. This allows the attacker to retrieve branch names, tag names, and revision metadata that they would otherwise be unauthorized to access. The issue is fixed in version 463.v496a_59f698e5, which now requires Item/Build permission to access this data.
Affected products
- Jenkins Project Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory