CVE-2026-92139 in Bitbucket Push and Pull Request Plugin
Summary
by MITRE • 09/16/2026
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Jenkins Bitbucket Push and Pull Request Plugin versions 4.0.1 and earlier stems from an insecure trust relationship regarding data received from external webhooks. Specifically, the plugin processes values contained within incoming webhook payloads without sufficient validation or sanitization of URL fields. When a push event or pull request update is triggered in Bitbucket, the associated payload includes metadata that may contain URLs intended for post-receive hooks or notification services. The flaw lies in the application's decision to accept these user-supplied or repository-configured URLs and subsequently initiate network connections using the Jenkins instance’s configured Bitbucket credentials against them. This behavior creates a critical authentication credential leakage vector, as the plugin does not restrict the destination of these requests to a predefined whitelist of trusted domains.
From a technical perspective, this flaw represents a classic case of Server-Side Request Forgery where the server acts on behalf of an attacker using privileged credentials. An adversary with write access to a Bitbucket repository or the ability to manipulate webhook configurations can craft a malicious payload containing a URL pointing to a server under their control. When Jenkins processes this event, it attempts to connect to the specified endpoint. Because the connection is established using the stored Bitbucket API tokens and passwords associated with the Jenkins instance, any HTTP request made by the plugin will include these credentials in standard authentication headers or cookies. Consequently, an attacker monitoring traffic on their controlled server can intercept and extract these sensitive authentication materials. This effectively compromises the integrity of the entire CI/CD pipeline's access to version control systems, as the stolen tokens grant full administrative capabilities over the linked Bitbucket account.
The operational impact of this vulnerability is severe, extending beyond simple credential theft to potential broader system compromise. Once an attacker possesses valid Bitbucket credentials obtained through this mechanism, they can clone private repositories, inject malicious code into branches, or modify pull requests to introduce vulnerabilities downstream in the development lifecycle. Furthermore, if Jenkins jobs are configured to trigger builds based on these webhook events, the compromised pipeline could be used to execute arbitrary commands under the context of the Jenkins agent, leading to full server takeover. This aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the environment or internal state, although in this specific case, it is more accurately categorized as CWE-798: Use of Hard-coded Credentials combined with CWE-918: Server-Side Request Forgery. The attacker leverages the trusted relationship between Jenkins and Bitbucket to exfiltrate secrets that are otherwise protected by network perimeter defenses.
In terms of threat modeling, this vulnerability facilitates actions consistent with MITRE ATT&CK technique T1530: Data from Cloud Storage Object or more specifically T1602: Sniffing Network Traffic if the attacker is in a position to intercept the traffic, but primarily it represents credential harvesting which supports lateral movement and persistence. The exploitation requires minimal privileges on the Bitbucket side, such as write access to a repository that triggers webhooks, making it accessible to insider threats or compromised developer accounts. To mitigate this risk, organizations must immediately upgrade the Jenkins Bitbucket Push and Pull Request Plugin to version 4.0.2 or later where these validation checks have been implemented. Additionally, administrators should review webhook configurations across all repositories to ensure no malicious endpoints are currently configured. Implementing strict URL allowlists within plugin settings can further reduce exposure by ensuring that only known internal services receive requests from Jenkins. Regular rotation of Bitbucket API tokens and passwords is also recommended as a defense-in-depth measure to limit the window of opportunity for attackers exploiting stolen credentials.