Is CVE-2026-57286 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57286 being exploited in the wild.

How severe is CVE-2026-57286?

Medium severity, with a CVSS score of 4.3, published 24 June 2026.

Which products and versions are affected?

Jenkins Project Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier; org.jenkins-ci.tools:git-parameter (Maven) < 462.463, ECOSYSTEM:introduced=0,fixed=462.463.

Is there a fix for CVE-2026-57286?

Yes. org.jenkins-ci.tools:git-parameter (Maven): upgrade to 462.463 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57286 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57286?

Check whether you run Jenkins Project Git Parameter Plugin or org.jenkins-ci.tools:git-parameter (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57286: Jenkins Git Parameter Plugin missing permission check in SCM metadata endpoint

Q: Is there a fix for CVE-2026-57286?

Yes. org.jenkins-ci.tools:git-parameter (Maven): upgrade to 462.463 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57286 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57286?

Check whether you run Jenkins Project Git Parameter Plugin or org.jenkins-ci.tools:git-parameter (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57286 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins Git Parameter Plugin, which allows users to select git branches or tags when starting a build, contains a security flaw. This vulnerability allows users who only have permission to view a job to also see sensitive metadata from the underlying source code repository, such as branch names, tags, and revision history. This could lead to the exposure of internal development details or project structure that should otherwise be restricted.

Technologies: org.jenkins-ci.tools:git-parameter (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57286 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57286 being exploited in the wild.
How severe is CVE-2026-57286?: Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?: Jenkins Project Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier; org.jenkins-ci.tools:git-parameter (Maven) < 462.463, ECOSYSTEM:introduced=0,fixed=462.463.
Is there a fix for CVE-2026-57286?: Yes. org.jenkins-ci.tools:git-parameter (Maven): upgrade to 462.463 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57286 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57286?: Check whether you run Jenkins Project Git Parameter Plugin or org.jenkins-ci.tools:git-parameter (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jenkins-ci.tools:git-parameter (Maven): upgrade to 462.463 or later

# set org.jenkins-ci.tools:git-parameter to 462.463 in your pom.xml or build.gradle

Technical details

The Git Parameter Plugin fails to perform an adequate permission check on an HTTP endpoint used to populate Git parameter values. By querying this endpoint, an attacker with Item/Read permission can trigger the plugin to fetch data from the configured SCM repository using Jenkins' stored credentials. This allows the attacker to retrieve branch names, tag names, and revision metadata that they would otherwise be unauthorized to access. The issue is fixed in version 463.v496a_59f698e5, which now requires Item/Build permission to access this data.

Affected products

Jenkins Project Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier

Identifiers

CVE-2026-57286
GHSA-hwvp-7xqv-8jx3

Timeline

2026-06-24: disclosed
2026-06-24: advisory

References

https://www.jenkins.io/security/advisory/2026-06-24/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.