CVE-2026-92139

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-18
Weakness: CWE-918

Description

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

Affected products

Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin: through 4.0.1

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3980

Get alerted when CVE-2026-92139 or the next vulnerability affects your stack