CVE-2026-57292
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier contains a CSRF vulnerability that allows attackers to connect to an attacker-specified URL using credentials IDs obtained through another method.
Risk Assessment
This vulnerability may lead to unauthorized access to system resources, posing a serious security threat to the organization.
Recommendation
It is recommended to update the Gitee Plugin to the latest version to mitigate this vulnerability and implement additional protections against CSRF attacks.
Other vulnerabilities in Jenkins Gitee Plugin
See all- CVE-2026-57293Medium
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier has an incorrect permission check, allowing attackers with global Item/Configure permission to enumerate credential IDs stored in Jenkins.
- CVE-2026-57291Medium
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier has missing permission checks, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential IDs obtained through another method.
Original NVD description (English source)
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.