GHSA-jwhr-h7pc-3974

Suggest an improvement
Source
https://github.com/advisories/GHSA-jwhr-h7pc-3974
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-jwhr-h7pc-3974/GHSA-jwhr-h7pc-3974.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jwhr-h7pc-3974
Aliases
  • CVE-2026-57289
Published
2026-06-24T15:31:47Z
Modified
2026-09-25T19:15:04Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Details

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the connections it makes to Bitbucket Server using Bearer token authentication.

Because the Bearer token is transmitted in these requests, this allows attackers able to intercept network traffic to capture the token and impersonate the Jenkins controller to Bitbucket Server.

Bitbucket Push and Pull Request Plugin 3.3.9 validates SSL/TLS certificates and hostnames for the connections it makes to Bitbucket Server using Bearer token authentication, using the trust store configured for the Jenkins controller JVM.

Database specific 
{
    "cwe_ids":  [
        "CWE-295"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-25T19:10:03Z",
    "nvd_published_at":  "2026-06-24T14:17:35Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / io.jenkins.plugins:bitbucket-push-and-pull-request

Package

Name
io.jenkins.plugins:bitbucket-push-and-pull-request
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugins/bitbucket-push-and-pull-request

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3.9

Affected versions

1.*
1.1
1.2
1.4
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3-beta-1
1.6.3
1.6.4
2.*
2.0.0
2.1.0-beta-1
2.1.0-beta-2
2.1.0-beta-3
2.1.0-beta-4
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
2.3.3
2.4.0
2.5
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.1
2.8.2-beta-1
2.8.2
2.8.3
2.8.4
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-jwhr-h7pc-3974/GHSA-jwhr-h7pc-3974.json"