CVE-2026-57292: Jenkins Gitee Plugin CSRF Vulnerability

CVE-2026-57292 Overview

CVE-2026-57292 is a cross-site request forgery (CSRF) vulnerability affecting the Jenkins Gitee Plugin version 1288.v18b_deb_c9069b_ and earlier. The flaw allows attackers to coerce authenticated Jenkins users into issuing requests that connect to an attacker-specified URL using credentials IDs obtained through another method. The vulnerability is tracked under [CWE-352] and was published to the National Vulnerability Database on 2026-06-24.

Critical Impact
An attacker exploiting this CSRF flaw can leverage stored Jenkins credentials to authenticate against arbitrary attacker-controlled endpoints, enabling credential abuse and unauthorized outbound connections.

Affected Products

Jenkins Gitee Plugin version 1288.v18b_deb_c9069b_
All Jenkins Gitee Plugin versions earlier than 1288.v18b_deb_c9069b_
Jenkins controllers with the vulnerable Gitee Plugin installed

Discovery Timeline

2026-06-24 - Jenkins publishes security advisory SECURITY-3762
2026-06-24 - CVE-2026-57292 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57292

Vulnerability Analysis

The Jenkins Gitee Plugin exposes an HTTP endpoint that performs a connection test against a user-supplied URL using a credentials ID also supplied by the user. The endpoint does not require a POST request with a valid CSRF crumb. As a result, an attacker can craft a malicious web page that triggers this request when visited by an authenticated Jenkins user with sufficient privileges.

When the victim's browser issues the forged request, Jenkins retrieves the credentials referenced by the supplied ID and transmits them to the attacker-controlled URL. The plugin treats the inbound request as legitimate because the victim's session cookies authenticate it.

Root Cause

The root cause is missing CSRF protection on a privileged plugin endpoint. The handler accepts GET requests and does not validate a request-specific token before performing the connection test. This violates Jenkins' standard requirement that form-submission actions use POST and verify a CSRF crumb.

Attack Vector

Exploitation requires the attacker to lure an authenticated Jenkins user to a malicious page. The attacker must also know or guess a valid credentials ID stored within Jenkins. Credentials IDs are not secrets and may be obtained through other low-privilege endpoints, project configurations, or build logs. Once the victim loads the attacker's page, the browser issues the cross-origin request and the plugin transmits the referenced credentials to the attacker's server.

No verified public exploit code is available. The vulnerability mechanism is described in the Jenkins Security Advisory 2026-06-24.

Detection Methods for CVE-2026-57292

Indicators of Compromise

Outbound HTTP/HTTPS connections from Jenkins controllers to unexpected or untrusted external hosts
Jenkins access logs showing GET requests to Gitee Plugin connection-test endpoints originating from cross-origin referers
Anomalous use of stored credentials IDs in proximity to user web browsing activity
Authentication attempts at external services using Jenkins-managed credentials from unfamiliar source IPs

Detection Strategies

Monitor Jenkins audit logs for requests to plugin descriptor URLs that include credentials ID parameters
Alert on Jenkins controller outbound traffic destined for hosts not on an approved Git or webhook allowlist
Inspect HTTP referer headers on Jenkins management endpoints for off-domain origins
Correlate browser activity of Jenkins administrators with Jenkins-initiated outbound requests

Monitoring Recommendations

Forward Jenkins access.log and audit.log to a centralized log platform for retention and query
Apply egress filtering on Jenkins controllers and alert on policy violations
Track plugin inventory and version state across all Jenkins controllers
Review credentials usage telemetry for Gitee-related credential bindings

How to Mitigate CVE-2026-57292

Immediate Actions Required

Inventory all Jenkins controllers and identify those running the Gitee Plugin at version 1288.v18b_deb_c9069b_ or earlier
Upgrade the Gitee Plugin to the fixed release referenced in the Jenkins advisory SECURITY-3762
Restrict Jenkins administrator browsing habits and require dedicated browsers or sessions for Jenkins management
Rotate any Gitee credentials suspected of exposure through this endpoint

Patch Information

Jenkins published advisory SECURITY-3762 on 2026-06-24. Administrators should apply the plugin update distributed through the Jenkins Update Center. See the Jenkins Security Advisory 2026-06-24 for the fixed version and remediation guidance.

Workarounds

Disable the Jenkins Gitee Plugin until the patched version can be installed
Limit which users hold the Overall/Read permission required to interact with vulnerable plugin endpoints
Apply network egress controls on the Jenkins controller to allow outbound HTTPS only to approved Gitee and source-control hosts
Enforce the Jenkins CSRF protection setting and confirm no exemptions are configured for the Gitee Plugin

bash

# Verify installed Gitee Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i gitee

# Disable the plugin pending patch deployment
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  disable-plugin gitee -restart