Skip to content
Sign in
6.5 Medium

CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload,…

Description

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

Affected products and versions

Product Affected versions Fixed in
Jenkins Bitbucket Push and Pull Request Plugin 4.0 earliest → 4.0.1 No fix stated

Other CVEs of Jenkins Bitbucket Push and Pull Request Plugin

The 3 CVEs of Jenkins Bitbucket Push and Pull Request Plugin →
CVE-2026-57289 Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and… 4.8 Medium CVE-2023-41937 Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the… Not rated
Track this CVE