Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Jenkins Bitbucket Plugin disables certificate checks, token can be stolen

CVE-2026-57289 · published 4 months ago
Summary

The Jenkins Bitbucket Push and Pull Request plugin (versions up to 3.3.8) disables the security checks that verify the identity of the Bitbucket Server it talks to. This means an attacker who can watch the network could capture the authentication token and impersonate the Jenkins server. Update the plugin to a newer version or stop using it until the fix is applied.

What to do
  • Update io.jenkins.plugins:bitbucket-push-and-pull-request to version 3.3.9.
  • Update jenkins bitbucket_push_and_pull_request to version 3.3.9 or later.
Affected software
Ecosystem VendorProductAffected versions
maven – io.jenkins.plugins:bitbucket-push-and-pull-request < 3.3.9
Fix: upgrade to 3.3.9
– jenkins bitbucket_push_and_pull_request < 3.3.9
cpe:2.3:a:jenkins:bitbucket_push_and_pull_request:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published24 Jun 2026
Updated26 Oct 2026
First seen24 Jun 2026
Sources
CVE-2026-57289 · NVD
GHSA-jwhr-h7pc-3974 · GHSA
Track software like this
Free during beta