PT-2026-51799 · Jenkins · Jenkins Bitbucket Push/Pull Request Plugin

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-57289

Mitre

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-57289

Produtos afetados

Jenkins Bitbucket Push/Pull Request Plugin

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-57289 · Nota de Segurança
• https://jenkins.io/security/advisory/2026-06-24/#SECURITY-3856 · Aviso do Fabricante