Executive brief
The Jenkins Bitbucket Push and Pull Request Plugin is used to automate code integration workflows by processing webhook events from Bitbucket repositories. Versions 4.0.1 and earlier are vulnerable to credential theft because they trust URLs provided in incoming webhook payloads and automatically use stored Bitbucket credentials to connect to those URLs, allowing attackers to intercept and capture stored credentials by crafting a malicious webhook payload.
Technical details
This is a credential capture vulnerability caused by insufficient validation of webhook payload content. The plugin accepts and uses URLs from the webhook payload without verifying they point to legitimate Bitbucket servers, and automatically authenticates to these URLs using pre-configured Bitbucket credentials. An attacker can send a crafted webhook to Jenkins pointing to an attacker-controlled server, causing the plugin to initiate authenticated connections that expose the stored credentials. The vulnerability requires network access to the Jenkins webhook endpoint and the ability to send a webhook (commonly exploitable if Jenkins is internet-facing). Jenkins Bitbucket Push and Pull Request Plugin 4.0.2 and later validate webhook URLs before use.
Affected products
- Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: Jenkins Security Advisory 2026-09-16