---
id: CVE-2026-57289
aliases:
  - GHSA-jwhr-h7pc-3974
title: >-
  Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables
  SSL/TLS certificate validation
summary: >-
  Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables
  SSL/TLS certificate validation
severity: medium
cvss: 4.8
cwe:
  - CWE-295
vendor: jenkins
product: 'io.jenkins.plugins:bitbucket-push-and-pull-request'
ecosystem: maven
affected:
  - 'io.jenkins.plugins:bitbucket-push-and-pull-request < 3.3.9'
patched:
  - 'io.jenkins.plugins:bitbucket-push-and-pull-request 3.3.9'
published: '2026-06-24'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:10:06Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-jwhr-h7pc-3974'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57289'
  - url: 'https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3856'
  - url: >-
      https://github.com/jenkinsci/bitbucket-push-and-pull-request-plugin/commit/5a0ae2155692beab48c6a0578a3eff22304a2014
  - url: >-
      https://github.com/jenkinsci/bitbucket-push-and-pull-request-plugin/releases/tag/bitbucket-push-and-pull-request-3.3.9
  - url: 'https://github.com/advisories/GHSA-jwhr-h7pc-3974'
tags:
  - ghsa
  - maven
epss: 0.00156
epssPercentile: 0.04022
ingestedAt: '2026-09-25T19:15:38.959Z'
---

## Overview

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the connections it makes to Bitbucket Server using Bearer token authentication.

Because the Bearer token is transmitted in these requests, this allows attackers able to intercept network traffic to capture the token and impersonate the Jenkins controller to Bitbucket Server.

Bitbucket Push and Pull Request Plugin 3.3.9 validates SSL/TLS certificates and hostnames for the connections it makes to Bitbucket Server using Bearer token authentication, using the trust store configured for the Jenkins controller JVM.

## Affected packages

- `io.jenkins.plugins:bitbucket-push-and-pull-request < 3.3.9`

## Remediation

Upgrade to a patched release:

- `io.jenkins.plugins:bitbucket-push-and-pull-request 3.3.9`