4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48925

CVE-2026-48925: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48925

CVE-2026-48925:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:github-integration-parent	maven	<= 0.7.3	0.7.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) in the Jenkins GitHub Integration Plugin. The root cause is that several web-accessible endpoints, which perform actions like triggering builds, did not require HTTP POST requests. This allowed an attacker to craft a malicious URL (e.g., in an <img> tag or a link) that, when accessed by a logged-in Jenkins user, would execute actions on their behalf.

The analysis of the patch between the vulnerable version (0.7.3) and the fixed version (0.7.4) reveals that the fix consists of adding the @RequirePOST annotation to several methods in GitHubTagRepository.java and GitHubPRRepository.java. This annotation is a standard mechanism in Jenkins plugins to prevent CSRF by ensuring that the annotated endpoint can only be invoked via POST requests.

The most critical vulnerable function is org.jenkinsci.plugins.github.pullrequest.GitHubPRRepository.doBuild, as it directly corresponds to the vulnerability description of allowing an attacker to "trigger a build for a pull request." Other methods like doClearRepo, doRunTrigger, and doRebuild were also vulnerable to the same CSRF issue and were fixed in the same commit, indicating they were also exploitable.

Vulnerable functions

com.github.kostyasha.github.integration.tag.GitHubTagRepository.doClearRepo

github-pullrequest-plugin/src/main/java/com/github/kostyasha/github/integration/tag/GitHubTagRepository.java

This method is a web-callable endpoint that lacked CSRF protection. Before the patch, it could be triggered by a GET request, allowing an attacker to trick a logged-in user into clearing the repository's tags via a malicious link. The fix adds the @RequirePOST annotation to ensure only POST requests are accepted.

com.github.kostyasha.github.integration.tag.GitHubTagRepository.doRunTrigger

github-pullrequest-plugin/src/main/java/com/github/kostyasha/github/integration/tag/GitHubTagRepository.java

This method is a web-callable endpoint that lacked CSRF protection. Before the patch, it could be triggered by a GET request, allowing an attacker to trick a logged-in user into running a trigger via a malicious link. The fix adds the @RequirePOST annotation to ensure only POST requests are accepted.

com.github.kostyasha.github.integration.tag.GitHubTagRepository.doRebuildAllFailed

github-pullrequest-plugin/src/main/java/com/github/kostyasha/github/integration/tag/GitHubTagRepository.java

This method is a web-callable endpoint that lacked CSRF protection. Before the patch, it could be triggered by a GET request, allowing an attacker to trick a logged-in user into rebuilding all failed builds via a malicious link. The fix adds the @RequirePOST annotation to ensure only POST requests are accepted.

com.github.kostyasha.github.integration.tag.GitHubTagRepository.doBuild

github-pullrequest-plugin/src/main/java/com/github/kostyasha/github/integration/tag/GitHubTagRepository.java

This method is a web-callable endpoint that lacked CSRF protection. Before the patch, it could be triggered by a GET request, allowing an attacker to trick a logged-in user into triggering a build for a tag via a malicious link. The fix adds the @RequirePOST annotation to ensure only POST requests are accepted.

com.github.kostyasha.github.integration.tag.GitHubTagRepository.doRebuild

github-pullrequest-plugin/src/main/java/com/github/kostyasha/github/integration/tag/GitHubTagRepository.java

This method is a web-callable endpoint that lacked CSRF protection. Before the patch, it could be triggered by a GET request, allowing an attacker to trick a logged-in user into rebuilding a specific build via a malicious link. The fix adds the @RequirePOST annotation to ensure only POST requests are accepted.

org.jenkinsci.plugins.github.pullrequest.GitHubPRRepository.doBuild

github-pullrequest-plugin/src/main/java/org/jenkinsci/plugins/github/pullrequest/GitHubPRRepository.java

This method is a web-callable endpoint that lacked CSRF protection. Before the patch, it could be triggered by a GET request, allowing an attacker to trick a logged-in user into triggering a build for a pull request via a malicious link. This is the primary impact described in the vulnerability advisory. The fix adds the @RequirePOST annotation to ensure only POST requests are accepted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-48925: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

CVE-2026-48925:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

4.3

4.3

Basic Information

Basic Information

CVE-2026-48925: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-48925: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

CVE-2026-48925:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

4.3

4.3

Basic Information

Basic Information

CVE-2026-48925: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI