CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

EUVD-2026-80763

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin (4.0.1 and earlier) trusts values in incoming webhook payloads, including certain URLs, and uses the plugin's configured Bitbucket credentials to connect to those attacker-supplied URLs. An unauthenticated attacker can send a crafted webhook to captu...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...