CVE-2026-57285: Jenkins GitHub Branch Source Plugin Information Disclosure Vulnerability

Technical summary

The GitHub Branch Source Plugin fails to enforce permission checks when exposing GitHub Enterprise server configuration details. An authenticated user holding only the Overall/Read permission can access the URLs of configured GitHub Enterprise instances through the plugin's global configuration. This violates the principle of least privilege and leaks sensitive server endpoint information. The vulnerability is classified as CWE-862 (Missing Authorization), indicating inadequate access control at the application layer. The CVSS 3.1 score of 4.3 reflects the low attack complexity and lack of impact beyond confidentiality of configuration metadata.

Business impact

Information disclosure of GitHub Enterprise URLs can help attackers map your organization's development infrastructure and plan targeted attacks against source control systems. While this vulnerability does not directly compromise code or credentials, it reduces operational security by exposing critical infrastructure topology. In organizations with strict separation of duties, this allows non-administrative users to discover integration points they should not know about. The impact is heightened in environments where GitHub Enterprise URLs are treated as sensitive due to custom authentication schemes, internal-only deployments, or integration with compliance monitoring.

Affected systems

Jenkins GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier are affected. Organizations running Jenkins with this plugin installed and configured to connect to GitHub Enterprise should assess their exposure. Patch releases addressing this vulnerability are available; consult the Jenkins security advisory for the specific patched version applicable to your deployment.

Exploitability

Exploitation requires valid Jenkins authentication and the Overall/Read permission, which is commonly granted to users who need to view job configurations or build history. The attack is trivial—no complex steps, special tools, or social engineering required. However, the vulnerability is not currently exploited in the wild according to available threat intelligence, and it does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations should not expect urgent external pressure, but internal threat models should account for the possibility of malicious insiders or compromised accounts.

Remediation

Upgrade Jenkins GitHub Branch Source Plugin to the patched version released after 1967.1969.v205fd594c821. Jenkins administrators should follow the standard plugin update workflow via the Jenkins plugin manager or download the patched version from the official Jenkins repository and deploy it manually. After updating, verify that global GitHub Enterprise configuration is no longer accessible to users lacking appropriate administrative permissions.

Patch guidance

1. Navigate to Manage Jenkins > Manage Plugins in your Jenkins interface. 2. Search for 'GitHub Branch Source' and check if an update is available. 3. If a patched version is available, select it and click Install (with or without a restart, depending on your policy). 4. Alternatively, download the patched plugin .hpi file directly from the Jenkins official repository and deploy via the plugin manager's 'Upload Plugin' option. 5. Restart Jenkins if required by your environment. 6. After patching, test that GitHub Enterprise configurations require appropriate administrative permissions to view. Note: Verify the exact patched version number against the official Jenkins security advisory before deploying to production.

Detection guidance

Audit Jenkins access logs for requests to the GitHub Branch Source global configuration endpoint (typically accessed via Manage Jenkins > Configure System or the REST API endpoint for plugin configuration). Review which users have accessed or attempted to access GitHub Enterprise server URLs. Implement role-based access control (RBAC) to restrict Overall/Read permission only to users who legitimately require it. Consider implementing Jenkins audit trails or webhook integrations with SIEM systems to track configuration access. If running Jenkins with GitHub authentication integration, cross-reference recent login sessions with configuration access events to identify potential unauthorized discovery attempts.

Why prioritize this

While rated MEDIUM severity, this vulnerability is best prioritized based on your organization's threat model. If your GitHub Enterprise infrastructure is considered sensitive, if you have a large population of Jenkins users with read permissions, or if you operate in a high-trust environment (e.g., finance, healthcare), patch sooner. In lower-risk environments with small, trusted Jenkins user bases, this can be bundled into regular maintenance windows. The absence from the KEV catalog suggests it is not currently a target for ransomware or APT campaigns, reducing external pressure to rush patching.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: a network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low privileges—specifically Overall/Read permission (PR:L), no user interaction (UI:N), unchanged scope (S:U), and confidentiality impact only (C:L with no integrity or availability impact). The score is driven down by the requirement for prior authentication and the limited scope of disclosure. It is not a high-severity issue from a numerical standpoint, but context matters: the actual risk to your organization depends on who has Overall/Read permission and how sensitive your GitHub infrastructure configuration is.

Frequently asked questions