CVE-2026-57289: Jenkins Bitbucket Push and Pull Request Plugin disabled SSL validation

CVE-2026-57289 · Severity: medium · CVSS 4.8 · Published 2026-06-24

The Jenkins Bitbucket Push and Pull Request Plugin is used to automate build triggers when code changes occur in Bitbucket. A security flaw in versions 3.3.8 and earlier causes the plugin to ignore security certificates when connecting to Bitbucket servers. This allows an attacker who can monitor network traffic to intercept sensitive login tokens, potentially gaining unauthorized access to the connected Bitbucket environment.

Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57289 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57289 being exploited in the wild.
How severe is CVE-2026-57289?
Medium severity, with a CVSS score of 4.8, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Bitbucket Push and Pull Request Plugin 3.3.8 and earlier; io.jenkins.plugins:bitbucket-push-and-pull-request (Maven) < 3.3.9, ECOSYSTEM:introduced=0,fixed=3.3.9.
Is there a fix for CVE-2026-57289?
Yes. io.jenkins.plugins:bitbucket-push-and-pull-request (Maven): upgrade to 3.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57289 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-57289?
Check whether you run Jenkins Project Bitbucket Push and Pull Request Plugin or io.jenkins.plugins:bitbucket-push-and-pull-request (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.jenkins.plugins:bitbucket-push-and-pull-request (Maven): upgrade to 3.3.9 or later
    # set io.jenkins.plugins:bitbucket-push-and-pull-request to 3.3.9 in your pom.xml or build.gradle

Technical details

The Jenkins Bitbucket Push and Pull Request Plugin (versions 3.3.8 and earlier) unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to configured Bitbucket Server endpoints. This vulnerability stems from a failure to enforce standard certificate chain verification during the HTTPS handshake. An attacker positioned to perform a Man-in-the-Middle (MitM) attack or otherwise intercept network traffic between the Jenkins controller and the Bitbucket Server can capture the Bearer token. This token can then be used to impersonate the Jenkins service and access the Bitbucket API. As of the advisory date, the reported severity is 'info' and no specific patch version was detailed in the provided snippet, though users are generally advised to check for updates from the Jenkins Project.

Affected products

  • Jenkins Project Bitbucket Push and Pull Request Plugin 3.3.8 and earlier

Identifiers

  • CVE-2026-57289
  • GHSA-jwhr-h7pc-3974

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.