CVE-2022-36884: The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information...

Security readout for executives and security teams

Unauthenticated users could learn whether Jenkins jobs exist for a specific Git repository through the Git Plugin webhook endpoint. This is information disclosure, not evidence of code execution or direct compromise in the supplied sources. Jenkins environments using Git Plugin 4.11.3 or earlier are potentially exposed, especially if Jenkins webhook endpoints are reachable by unauthenticated users or from the internet. Treat as a moderate-priority Jenkins hygiene issue. It can aid attacker reconnaissance but supplied evidence does not show active exploitation or direct system compromise. Mitigation focus: Check Jenkins advisory SECURITY-284 for the vendor-recommended fixed Git Plugin version.; Upgrade Jenkins Git Plugin according to official Jenkins guidance.; Restrict unauthenticated network access to Jenkins and webhook endpoints..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.