CVE-2026-48925: Jenkins GitHub Integration Plugin CSRF

CVE-2026-48925 Overview

CVE-2026-48925 is a cross-site request forgery (CSRF) vulnerability affecting the Jenkins GitHub Integration Plugin version 0.7.3 and earlier. The flaw allows attackers to trigger a build for a pull request without proper authorization checks. Exploitation requires user interaction, typically by enticing an authenticated Jenkins user to visit a malicious page. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and was disclosed in the Jenkins Security Advisory SECURITY-3776.

Critical Impact

Attackers can trigger arbitrary pull request builds in Jenkins, potentially executing untrusted code from external pull requests in the CI/CD environment.

Affected Products

• Jenkins GitHub Integration Plugin 0.7.3
• Jenkins GitHub Integration Plugin earlier than 0.7.3

Discovery Timeline

• 2026-05-27 - CVE CVE-2026-48925 published to NVD
• 2026-05-27 - Jenkins Security Advisory SECURITY-3776 released
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48925

Vulnerability Analysis

The Jenkins GitHub Integration Plugin exposes an HTTP endpoint that triggers builds for GitHub pull requests. The endpoint lacks adequate CSRF protection in version 0.7.3 and earlier. An attacker who crafts a malicious web page can cause an authenticated Jenkins user's browser to issue a request to the vulnerable endpoint. The request reuses the victim's Jenkins session cookies, allowing the attacker to initiate a pull request build under the victim's identity.

Triggering a build for an arbitrary pull request can lead to execution of attacker-supplied code in the Jenkins build environment. This is significant because CI/CD systems often have access to source repositories, build artifacts, deployment credentials, and downstream production systems.

Root Cause

The root cause is missing or insufficient CSRF token validation on the build-triggering endpoint provided by the plugin. Jenkins normally requires a crumb token for state-changing requests. The affected plugin endpoint does not enforce this requirement, classifying the issue as [CWE-352].

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a page containing a forged request (for example, an auto-submitting form or image tag) that targets the vulnerable plugin endpoint. When an authenticated Jenkins user with build-trigger permissions loads that page, the browser sends the request with valid session credentials. The plugin processes the request and triggers a build for a pull request chosen by the attacker. No code example is published for this issue. See the Jenkins Security Advisory SECURITY-3776 for vendor technical details.

Detection Methods for CVE-2026-48925

Indicators of Compromise

• Unexpected build executions tied to pull requests that were not manually triggered by an authorized user.
• Jenkins access logs showing build-trigger requests from external HTTP Referer headers or unusual origins.
• Builds initiated immediately after a Jenkins user visited an unfamiliar external web page.

Detection Strategies

• Review Jenkins audit logs for pull request build events that lack corresponding user-initiated actions in the Jenkins UI.
• Correlate web proxy or browser telemetry with Jenkins access logs to identify cross-origin requests targeting plugin endpoints.
• Hunt for builds executing code from unmerged or external-contributor pull requests outside normal review windows.

Monitoring Recommendations

• Enable detailed access logging on the Jenkins controller and forward logs to a centralized SIEM for analysis.
• Alert on HTTP requests to GitHub Integration Plugin endpoints that carry external Referer headers.
• Monitor build queues for anomalous frequency or pull request build patterns inconsistent with development activity.

How to Mitigate CVE-2026-48925

Immediate Actions Required

• Upgrade the Jenkins GitHub Integration Plugin to a version newer than 0.7.3 once a fixed release is available.
• Review recent pull request builds for unauthorized executions and inspect any artifacts or deployments produced.
• Restrict Jenkins user permissions so that fewer accounts hold build-trigger privileges on sensitive jobs.

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3776 for the authoritative list of fixed versions and remediation guidance. Apply the vendor-supplied update through the Jenkins Plugin Manager once available.

Workarounds

• Disable the Jenkins GitHub Integration Plugin until a patched version is installed if pull request build automation is not essential.
• Require Jenkins users to log out of administrative sessions when not actively using the controller to reduce CSRF exposure.
• Enforce strict reverse-proxy rules that drop cross-origin requests to Jenkins endpoints lacking valid CSRF crumbs.

# Configuration example: list installed plugin version and disable if needed
jenkins-cli -s "$JENKINS_URL" list-plugins | grep github-pullrequest
jenkins-cli -s "$JENKINS_URL" disable-plugin github-pullrequest