CVE-2026-57291
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier has missing permission checks, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential IDs obtained through another method.
Risk Assessment
The lack of proper permission checks may lead to unauthorized access to resources, posing a risk of data leakage or system takeover.
Recommendation
It is recommended to update the Gitee Plugin to the latest version to mitigate the security vulnerability and implement additional permission checks.
Original NVD description (English source)
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.