CVE-2026-48925 Detail

Nvd.Nist • May 28, 2026

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities Discovered in Jenkins Plugins Two significant vulnerabilities have been identified in Jenkins plugins, CVE-2026-48922 and CVE-2026-48925. The Jenkins Credentials Binding Plugin allows attackers to write files to arbitrary locations, potentially leading to remote code execution. This affects versions 720.v3f6decef43ea_ and earlier. The second vulnerability, CVE-2026-48925, is a cross-site request forgery (CSRF) flaw in the Jenkins GitHub Integration Plugin, enabling attackers to trigger builds for pull requests. Both vulnerabilities were published on May 27, 2026, and pose serious risks to Jenkins users. Immediate action is recommended to mitigate these threats. 2 sources 72

Extracted Entities

CVE-2026-48925 Detail

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)