Medium severity · published Jun 24, 2026
CVE-2026-57289
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token…
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JB
Jenkins Bitbucket Push and Pull Request Plugin · Jenkins Project
through 3.3.8 · source: vendor
BP
Bitbucket Push And Pull Request · Jenkins
before 3.3.9 · source: NVD
Affected product
JB
Jenkins Bitbucket Push and Pull Request Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57289
Vendor Advisory
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3856
More from Jenkins Bitbucket Push and Pull Request Plugin
6.5
CVE-2026-92139
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials…