# CVE-2026-57292: Jenkins Gitee Plugin CSRF in connection endpoint

Source: https://junglewise.ai/threats/cve-2026-57292-jenkins-gitee-plugin-csrf-in-connection-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-57292 · Severity: medium · CVSS 5.4 · Published 2026-06-24

A security vulnerability exists in the Jenkins Gitee Plugin, which is used to integrate Jenkins with the Gitee code hosting platform. An attacker could trick a user into clicking a malicious link, causing the Jenkins server to connect to an unauthorized web address using existing credentials. This could lead to unauthorized internal network scanning or the misuse of stored authentication tokens.

Technologies: [Jenkins Project Gitee Plugin](https://junglewise.ai/threats/technologies/gitee-plugin), [org.jenkins-ci.plugins:gitee (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-gitee). Vendors: [Jenkins Project](https://junglewise.ai/threats/vendors/jenkins-project), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-57292 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57292 being exploited in the wild.

**How severe is CVE-2026-57292?** Medium severity, with a CVSS score of 5.4, published 24 June 2026.

**Which products and versions are affected?** Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier; org.jenkins-ci.plugins:gitee (Maven) < 1292.v2559f2f3f2c0, ECOSYSTEM:introduced=0,fixed=1292.v2559f2f3f2c0.

**Is there a fix for CVE-2026-57292?** Yes. org.jenkins-ci.plugins:gitee (Maven): upgrade to 1292.v2559f2f3f2c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57292 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57292?** Check whether you run Jenkins Project Gitee Plugin or org.jenkins-ci.plugins:gitee (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:gitee (Maven): upgrade to 1292.v2559f2f3f2c0 or later

  ```sh
  # set org.jenkins-ci.plugins:gitee to 1292.v2559f2f3f2c0 in your pom.xml or build.gradle
  ```


## Technical details

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Gitee Plugin due to insufficient validation of HTTP requests in an endpoint responsible for testing connections. Attackers can exploit this by inducing a logged-in user to submit a crafted request, which forces the Jenkins controller to connect to an arbitrary URL. The attack can leverage credential IDs previously obtained through other methods to authenticate these outbound requests. This can be used for Server-Side Request Forgery (SSRF) or to verify the validity of stolen credential identifiers. As of the advisory date, users should look for updates to the Gitee Plugin to mitigate this issue.

## Affected products

- Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier

## Identifiers

- CVE-2026-57292
- GHSA-w794-rwp2-jc9m

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: advisory

## References

- [https://www.jenkins.io/security/advisory/2026-06-24/](https://www.jenkins.io/security/advisory/2026-06-24/)

## Related threats

- [Jenkins Gitee Plugin incorrect permission check allows credential ID enumeration](https://junglewise.ai/threats/cve-2026-57293-jenkins-gitee-plugin-incorrect-permission-check-allows-credential)
- [Jenkins Gitee Plugin missing permission check in connection endpoint](https://junglewise.ai/threats/cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection)