CVE-2026-57293: Jenkins Gitee Plugin Info Disclosure Flaw

CVE-2026-57293 Overview

CVE-2026-57293 is a missing authorization vulnerability [CWE-862] in the Jenkins Gitee Plugin. Versions 1288.v18b_deb_c9069b_ and earlier perform an incorrect permission check that allows authenticated attackers to enumerate credentials IDs stored in Jenkins. Exploitation requires the global Item/Configure permission but does not require Item/Configure permission on any specific job. The flaw enables reconnaissance of credential identifiers that can support follow-on attacks against the Jenkins controller and connected systems.

Critical Impact
Authenticated users with limited global configuration rights can enumerate credentials IDs in Jenkins, exposing identifiers that may be abused in conjunction with other plugin vulnerabilities to capture credential contents.

Affected Products

Jenkins Gitee Plugin version 1288.v18b_deb_c9069b_
All Jenkins Gitee Plugin versions earlier than 1288.v18b_deb_c9069b_
Jenkins controllers integrating the Gitee Plugin for SCM workflows

Discovery Timeline

2026-06-24 - Jenkins publishes security advisory SECURITY-3762
2026-06-24 - CVE-2026-57293 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57293

Vulnerability Analysis

The Jenkins Gitee Plugin exposes an HTTP endpoint that returns credentials IDs available for use in job configuration. The endpoint enforces a permission check, but the check is incorrect. It validates that the requester holds the global Item/Configure permission instead of verifying Item/Configure permission on the specific job context. As a result, any authenticated user granted the global form of this permission can query the endpoint and receive a list of credentials IDs stored in Jenkins, even when the user lacks rights to any individual job. The exposed credentials IDs are opaque identifiers, not secret values. However, identifier disclosure aids attackers performing reconnaissance, as IDs can be combined with other credential exfiltration weaknesses in Jenkins plugins to retrieve the underlying secrets.

Root Cause

The root cause is a broken access control implementation [CWE-862]. The plugin checks permissions at the global scope rather than at the per-item scope required by the operation. This violates the Jenkins permission model, which expects credential enumeration endpoints to be gated on the permission context of the target item. The check effectively grants visibility to a population of users intended to be excluded.

Attack Vector

Exploitation is performed over the network against the Jenkins web interface. The attacker authenticates with an account that has global Item/Configure permission, then issues a crafted HTTP request to the Gitee Plugin's credentials listing endpoint. The plugin returns the enumeration despite the user lacking item-scoped configure rights. No user interaction is required, and the attack complexity is low. Refer to the Jenkins Security Advisory for endpoint specifics.

Detection Methods for CVE-2026-57293

Indicators of Compromise

Unexpected HTTP requests to Jenkins Gitee Plugin endpoints that return credentialsId values
Authenticated users without job-level permissions issuing repeated requests to credentials enumeration URLs
Access log entries showing low-privileged accounts querying plugin configuration endpoints

Detection Strategies

Audit Jenkins access logs for HTTP requests to Gitee Plugin descriptor URLs originating from users without item-scoped permissions
Compare the installed Gitee Plugin version against 1288.v18b_deb_c9069b_ using the Jenkins Plugin Manager or the /pluginManager/api/json endpoint
Review the Jenkins permission matrix for accounts holding global Item/Configure without legitimate need

Monitoring Recommendations

Forward Jenkins controller access logs and audit logs to a centralized log platform for correlation
Alert on anomalous enumeration patterns from non-administrator accounts against /descriptorByName/ plugin endpoints
Track plugin version inventory across Jenkins controllers to identify outdated Gitee Plugin installations

How to Mitigate CVE-2026-57293

Immediate Actions Required

Upgrade the Jenkins Gitee Plugin to a version later than 1288.v18b_deb_c9069b_ once a fixed release is available from the maintainer
Review and reduce assignments of global Item/Configure permission to the minimum set of trusted users
Rotate any credentials whose IDs may have been disclosed if the controller is shared with untrusted users

Patch Information

Consult the Jenkins Security Advisory for SECURITY-3762 for the fixed plugin version and upgrade instructions. Apply the update through the Jenkins Plugin Manager or by deploying the patched .hpi artifact to the controller's plugins directory.

Workarounds

Restrict global Item/Configure permission until the plugin is patched, granting only item-scoped permissions through folder or job authorization
Use role-based access control to segment users away from controllers hosting sensitive credentials
Disable the Gitee Plugin if Gitee integration is not in active use

bash

# Verify installed Gitee Plugin version on a Jenkins controller
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="gitee") | {shortName, version, enabled}'