CVE-2026-57286: Jenkins Git Parameter Plugin Information Disclosure via Missing Permission Check

Technical summary

CVE-2026-57286 is an authorization bypass in Jenkins Git Parameter Plugin version 462.vdcf3df2ed2ca_ and earlier stemming from missing permission validation (CWE-862). The plugin fails to enforce fine-grained access controls when handling SCM repository queries. Users authenticated with Item/Read permission—typically granted for visibility into job configurations—can call plugin functions that return repository metadata (branches, tags, revisions) without the plugin verifying whether the caller should have access to that SCM data. The vulnerability is network-accessible and requires only valid Jenkins authentication; no additional user interaction is needed.

Business impact

This disclosure can enable privilege escalation reconnaissance. An attacker with read-only access to Jenkins—perhaps a junior developer or contractor with limited scope—gains visibility into repository structures and history that may be confidential or reveal internal development practices. In organizations using Git branching strategies to segment work by sensitivity level, exposure of branch names alone can leak project planning or security research initiatives. Combined with other enumeration, this becomes a stepping stone toward lateral movement or more targeted attacks on the SCM system itself.

Affected systems

Jenkins instances running Git Parameter Plugin version 462.vdcf3df2ed2ca_ or earlier are affected. The vulnerability applies regardless of Jenkins deployment model (on-premises, cloud-hosted, containerized). Any organization using this plugin for parameterized job builds that query Git repositories is in scope. The risk surface is primarily Jenkins administrators and users with Item/Read permission on jobs using the Git Parameter Plugin.

Exploitability

Exploitation is straightforward and requires no special tooling beyond standard Jenkins API access. An attacker must already be authenticated to Jenkins and have Item/Read permission—a relatively permissive baseline—on at least one affected job. From there, invoking the Git Parameter Plugin's metadata functions reveals repository details without additional friction. The CVSS 3.1 score of 4.3 (MEDIUM) reflects the low attack complexity, low privilege requirement for initial access, and limited scope of impact (confidentiality only), though the information disclosed can enable follow-on attacks.

Remediation

Update Jenkins Git Parameter Plugin to a patched version beyond 462.vdcf3df2ed2ca_. Verify the specific patched version against the official Jenkins security advisory and your plugin update channels. Until patching is possible, restrict Item/Read permission grants to only users who should have legitimate visibility into job configurations and the repositories they use. Consider using Jenkins' role-based access control (RBAC) plugins to enforce more granular authorization policies and minimize unnecessary exposure of job details.

Patch guidance

Apply the latest patched release of Jenkins Git Parameter Plugin as published by the Jenkins project. Confirm the version number in your Jenkins plugin manager after installation. Restart Jenkins or reload configurations if required by the specific patch. Test patched functionality in a non-production environment first, particularly if your organization relies heavily on parameterized Git jobs, to ensure no workflow disruption. Verify against the official Jenkins security advisory for any breaking changes or migration guidance.

Detection guidance

Monitor Jenkins audit logs for unusual queries to Git Parameter Plugin functions, especially from users or service accounts with only Item/Read permission. Look for patterns such as repeated calls to retrieve branch or tag lists from repositories not typically accessed by those users. If you have access to Jenkins logs or plugin telemetry, correlate spikes in SCM metadata requests with changes in user roles or suspicious authentication events. Network-side detection is challenging because the traffic is legitimate Jenkins API activity; host-based log analysis is more effective.

Why prioritize this

Although the CVSS score is MEDIUM (4.3) and the vulnerability is not tracked in the CISA KEV catalog, it merits prompt remediation because it enables low-friction reconnaissance in Jenkins environments. The barrier to exploitation is minimal—existing authentication only—and the disclosed information (repository structure, revision history) can directly inform targeted attacks. Organizations should prioritize this alongside any other Jenkins security updates, especially those where job visibility is already broader than ideal or where repositories contain sensitive information.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability requiring authenticated access (PR:L) and permitting only confidentiality impact (C:L, I:N, A:N). Attack complexity is low; no user interaction is required. The lack of integrity or availability impact prevents a higher rating, but the ease of exploitation and the real-world utility of the disclosed information for follow-on attacks justify treating it as a material security concern rather than a low-severity finding.

Frequently asked questions