UNKNOWN NVD

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitb

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3980

Published: 2026-09-16 · Source: NVD · Feed updated: 2026-09-16

This unknown severity vulnerability was published on 2026-09-16 via NVD.

vulnfeed aggregates 14391 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.