CVE-2026-48925: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

May 27, 2026 (updated July 1, 2026)

Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to trigger a build for a pull request.

GitHub Integration Plugin 0.7.4 requires POST requests for the affected HTTP endpoint.

References

github.com/advisories/GHSA-rf8w-7c3g-7h3g
nvd.nist.gov/vuln/detail/CVE-2026-48925
www.jenkins.io/security/advisory/2026-05-27/

Code Behaviors & Features

Detect and mitigate CVE-2026-48925 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →