Jenkins Bitbucket Push and Pull Request Plugin vulnerabilities

Product

Jenkins Bitbucket Push and Pull Request Plugin

by Jenkins Project · last CVE Sep 16, 2026

CVEs

On KEV

6.5

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 2Low 0

Severity

Exploitation

Watch

Add Jenkins Bitbucket Push and Pull Request Plugin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-92139	6.5	0%	Sep 16	Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials… Affected: through 4.0.1
CVE-2026-57289	4.8	0%	Jun 24	Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token… Affected: through 3.3.8