Skip to content
Sign in
4.8 Medium

CVE-2026-57289 Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and…

Description

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.

Affected products and versions

Product Affected versions Fixed in
Jenkins Bitbucket Push and Pull Request Plugin 3.3 earliest → 3.3.8 No fix stated

Other CVEs of Jenkins Bitbucket Push and Pull Request Plugin

The 3 CVEs of Jenkins Bitbucket Push and Pull Request Plugin →
CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload,… 6.5 Medium CVE-2023-41937 Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the… Not rated
Track this CVE