CVE-2022-36882: A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers...

Security readout for executives and security teams

This vulnerability lets an attacker abuse a logged-in Jenkins user’s browser to start certain Git-based builds using a repository and commit chosen by the attacker. The public bundle does not provide CVSS, confirmed exploitation, or business impact beyond the build-triggering behavior. Exposure is likely limited to Jenkins instances using Git Plugin 4.11.3 or earlier with jobs that can use externally supplied repository and commit parameters. Treat this as a timely CI/CD integrity issue. It is not documented here as actively exploited, but affected Jenkins jobs could run code from attacker-chosen sources, which can undermine build trust. Mitigation focus: Check Jenkins advisory SECURITY-284 for the vendor-approved fixed version or workaround.; Upgrade Jenkins Git Plugin beyond the affected range when vendor guidance confirms the target version.; Restrict who can trigger or configure affected Jenkins jobs until remediation is complete..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.