CVE-2026-92139: Jenkins Bitbucket Push and Pull Request Plugin vulnerability
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to be able to send a crafted webhook payload to Jenkins that is processed by the Bitbucket Push and Pull Request Plugin. The payload supplies attacker-controlled URL values that Jenkins may contact using configured Bitbucket credentials.
Which credentials are at risk?
Bitbucket credentials stored in Jenkins and configured for use by the plugin are at risk. The issue can allow an attacker to capture those credentials when Jenkins connects to an attacker-controlled URL from the webhook payload.
Are deployments using the affected plugin version exposed by default?
The provided information confirms that version 4.0.1 and earlier are affected, but does not state whether a default configuration is vulnerable. Exposure depends on Jenkins processing attacker-crafted webhook payloads and having Bitbucket credentials configured for the plugin.
How can I determine whether my Jenkins instance is affected?
Check whether the Jenkins Bitbucket Push and Pull Request Plugin is installed at version 4.0.1 or earlier. Also identify whether the plugin has configured Bitbucket credentials and whether its webhook endpoint can receive payloads from untrusted sources.