Executive brief
A security vulnerability exists in the Jenkins Gitee Plugin, which is used to integrate Jenkins with the Gitee code hosting platform. An attacker could trick a user into clicking a malicious link, causing the Jenkins server to connect to an unauthorized web address using existing credentials. This could lead to unauthorized internal network scanning or the misuse of stored authentication tokens.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Gitee Plugin due to insufficient validation of HTTP requests in an endpoint responsible for testing connections. Attackers can exploit this by inducing a logged-in user to submit a crafted request, which forces the Jenkins controller to connect to an arbitrary URL. The attack can leverage credential IDs previously obtained through other methods to authenticate these outbound requests. This can be used for Server-Side Request Forgery (SSRF) or to verify the validity of stolen credential identifiers. As of the advisory date, users should look for updates to the Gitee Plugin to mitigate this issue.
Affected products
- Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory