CVE-2026-92139: Jenkins Bitbucket Plugin Credential Theft

CVE-2026-92139 Overview

CVE-2026-92139 is a Server-Side Request Forgery (SSRF) vulnerability in the Jenkins Bitbucket Push and Pull Request Plugin, versions 4.0.1 and earlier. The plugin trusts URL values supplied in incoming webhook payloads and uses configured Bitbucket credentials when connecting to those URLs. An unauthenticated attacker can send a crafted webhook payload that forces Jenkins to authenticate against an attacker-controlled endpoint, exposing stored Bitbucket credentials. The flaw is tracked under CWE-918: Server-Side Request Forgery and documented in Jenkins Security Advisory SECURITY-3980.

Critical Impact
Attackers can capture Bitbucket credentials stored in Jenkins by delivering a crafted webhook payload, enabling downstream access to source code repositories.

Affected Products

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1
Jenkins Bitbucket Push and Pull Request Plugin, all prior 4.x releases
Jenkins controllers with the affected plugin installed and Bitbucket credentials configured

Discovery Timeline

2026-09-16 - CVE-2026-92139 published to NVD
2026-09-16 - Jenkins publishes Security Advisory SECURITY-3980
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92139

Vulnerability Analysis

The Bitbucket Push and Pull Request Plugin processes incoming webhook events from Bitbucket to trigger Jenkins jobs. The plugin extracts URL fields from the webhook payload and issues outbound HTTP requests to those URLs using stored Bitbucket credentials. Because the payload originates from an unauthenticated HTTP endpoint on the Jenkins controller, any network-reachable attacker can supply arbitrary URL values.

The result is a classic SSRF condition combined with credential exposure. When Jenkins connects to the attacker-supplied host, it attaches the configured Bitbucket credentials during authentication. The attacker's endpoint captures those credentials, which typically include personal access tokens or app passwords with repository read and write scope.

Root Cause

The root cause is missing validation of URL fields in the webhook payload. The plugin treats webhook-supplied URLs as trusted destinations and does not restrict outbound requests to known Bitbucket hosts. This design pattern is the core failure mode described by [CWE-918].

Attack Vector

Exploitation requires network access to the Jenkins webhook endpoint but no authentication or user interaction. An attacker crafts a JSON webhook payload matching the Bitbucket event schema and substitutes URL fields with an attacker-controlled host. Upon receipt, Jenkins issues an authenticated HTTPS request to that host, sending the configured Bitbucket credentials. The attacker logs the incoming request and extracts the credential material for reuse against Bitbucket.

No verified proof-of-concept code is published. See Jenkins Security Advisory SECURITY-3980 for vendor technical details.

Detection Methods for CVE-2026-92139

Indicators of Compromise

Outbound HTTPS connections from the Jenkins controller to hosts that are not bitbucket.org, api.bitbucket.org, or an approved Bitbucket Data Center endpoint.
Webhook POST requests to /bitbucket-hook/ or /bitbucket-scmsource-hook/notify containing URL fields pointing to unknown external domains.
Unexpected Bitbucket audit log entries showing authentication from new IP addresses shortly after suspicious webhook traffic.

Detection Strategies

Inspect Jenkins access logs for POST requests to the Bitbucket webhook endpoints and parse the payload URL fields against an allowlist of expected Bitbucket hosts.
Correlate outbound network flows from the Jenkins controller with the domains referenced in received webhook payloads.
Alert on Bitbucket API activity originating from IP addresses that do not match the Jenkins controller egress IP.

Monitoring Recommendations

Enable verbose logging on the Bitbucket Push and Pull Request Plugin and forward events to a centralized log platform.
Monitor the plugin version inventory across Jenkins controllers to detect installations still running 4.0.1 or earlier.
Track Bitbucket credential usage patterns and rotate any credentials that show anomalous source addresses.

How to Mitigate CVE-2026-92139

Immediate Actions Required

Upgrade the Bitbucket Push and Pull Request Plugin to a version later than 4.0.1 as directed by Jenkins Security Advisory SECURITY-3980.
Rotate all Bitbucket credentials stored in Jenkins, including app passwords, access tokens, and OAuth secrets tied to the plugin.
Audit Jenkins system logs and Bitbucket access logs for the past 30 days to identify potential credential exposure.

Patch Information

Jenkins has published a fixed release referenced in Security Advisory SECURITY-3980. Administrators should install the patched plugin version through the Jenkins Update Center and restart the controller to complete remediation.

Workarounds

Restrict network access to the Jenkins webhook endpoints so that only Bitbucket source IP ranges can reach /bitbucket-hook/ and related paths.
Enforce egress filtering on the Jenkins controller to permit outbound connections only to approved Bitbucket hostnames.
Disable the affected plugin until the patched version is installed if webhook-triggered builds are not business-critical.

bash

# Example nginx allowlist limiting webhook access to Bitbucket Cloud egress ranges
location /bitbucket-hook/ {
    allow 18.205.93.0/25;
    allow 18.234.32.128/25;
    allow 13.52.5.0/25;
    deny all;
    proxy_pass http://jenkins-controller:8080;
}