Executive brief
The Jenkins Bitbucket Push and Pull Request Plugin is used to automate build triggers when code changes occur in Bitbucket. A security flaw in versions 3.3.8 and earlier causes the plugin to ignore security certificates when connecting to Bitbucket servers. This allows an attacker who can monitor network traffic to intercept sensitive login tokens, potentially gaining unauthorized access to the connected Bitbucket environment.
Technical details
The Jenkins Bitbucket Push and Pull Request Plugin (versions 3.3.8 and earlier) unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to configured Bitbucket Server endpoints. This vulnerability stems from a failure to enforce standard certificate chain verification during the HTTPS handshake. An attacker positioned to perform a Man-in-the-Middle (MitM) attack or otherwise intercept network traffic between the Jenkins controller and the Bitbucket Server can capture the Bearer token. This token can then be used to impersonate the Jenkins service and access the Bitbucket API. As of the advisory date, the reported severity is 'info' and no specific patch version was detailed in the provided snippet, though users are generally advised to check for updates from the Jenkins Project.
Affected products
- Jenkins Project Bitbucket Push and Pull Request Plugin 3.3.8 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory