Is CVE-2026-57293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57293 being exploited in the wild.

How severe is CVE-2026-57293?

Medium severity, with a CVSS score of 4.3, published 24 June 2026.

Which products and versions are affected?

Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier; org.jenkins-ci.plugins:gitee (Maven) < 1292.v2559f2f3f2c0, ECOSYSTEM:introduced=0,fixed=1292.v2559f2f3f2c0.

Is there a fix for CVE-2026-57293?

Yes. org.jenkins-ci.plugins:gitee (Maven): upgrade to 1292.v2559f2f3f2c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57293 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57293?

Check whether you run Jenkins Project Gitee Plugin or org.jenkins-ci.plugins:gitee (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57293: Jenkins Gitee Plugin incorrect permission check allows credential ID enumeration

Q: Is there a fix for CVE-2026-57293?

Yes. org.jenkins-ci.plugins:gitee (Maven): upgrade to 1292.v2559f2f3f2c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57293 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57293?

Check whether you run Jenkins Project Gitee Plugin or org.jenkins-ci.plugins:gitee (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57293 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins Gitee Plugin, which integrates Jenkins with the Gitee code hosting platform, contains a security flaw in how it checks user permissions. This flaw allows users who have general configuration privileges to see the identification labels of credentials stored in the system, even if they shouldn't have access to specific projects. While this does not expose the actual passwords or secret keys, it reveals metadata about the security credentials used within the organization.

Technologies: Jenkins Project Gitee Plugin, org.jenkins-ci.plugins:gitee (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57293 being exploited in the wild.
How severe is CVE-2026-57293?: Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?: Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier; org.jenkins-ci.plugins:gitee (Maven) < 1292.v2559f2f3f2c0, ECOSYSTEM:introduced=0,fixed=1292.v2559f2f3f2c0.
Is there a fix for CVE-2026-57293?: Yes. org.jenkins-ci.plugins:gitee (Maven): upgrade to 1292.v2559f2f3f2c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57293 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57293?: Check whether you run Jenkins Project Gitee Plugin or org.jenkins-ci.plugins:gitee (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jenkins-ci.plugins:gitee (Maven): upgrade to 1292.v2559f2f3f2c0 or later

# set org.jenkins-ci.plugins:gitee to 1292.v2559f2f3f2c0 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Jenkins Gitee Plugin due to an improper permission check in an HTTP endpoint. Specifically, users possessing the global 'Item/Configure' permission can list and enumerate the IDs of credentials stored in Jenkins, even if they lack the specific 'Item/Configure' permission for individual jobs. This is a metadata leakage vulnerability where credential identifiers are exposed, though the underlying secrets themselves are not directly revealed through this specific flaw. The issue affects version 1288.v18b_deb_c9069b_ and all prior versions.

Affected products

Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier

Identifiers

CVE-2026-57293
GHSA-jhcq-6wqp-qcfx

Timeline

2026-06-24: disclosed
2026-06-24: advisory

References

https://www.jenkins.io/security/advisory/2026-06-24/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.