CVE-2026-57291
Description
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
Summary dbcve.org
The Jenkins Gitee Plugin lacks permission checks, allowing any user with Overall/Read permission to trigger the Jenkins server to connect to attacker-specified URLs using credentials IDs obtained through another method. This creates an SSRF-like vulnerability where authenticated low-privilege users can make the Jenkins server make arbitrary HTTP requests to internal or external services.
Mitigation
Upgrade the Jenkins Gitee Plugin to version 1288.v18b_deb_c9069b_ or later, which includes proper permission checks. Review and rotate any credentials that may have been exposed.