CVE-2026-92139

The Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier blindly trusts values supplied in a webhook payload, including certain URLs, and then connects to those attacker-controlled URLs using the Bitbucket credentials configured in Jenkins (CWE-918, server-side request forgery). An unauthenticated attacker who can reach the plugin's webhook endpoint can send a crafted payload pointing at a server they control, causing Jenkins to authenticate to that server and thereby reveal the stored Bitbucket credentials. Successful exploitation gives the attacker the Bitbucket credentials held in Jenkins, which can lead to unauthorized access to the connected source code repositories. Any Jenkins controller running the plugin at version 4.0.1 or earlier is affected, provided the webhook endpoint is reachable and Bitbucket credentials are configured. As of now there is no known exploitation, no public proof-of-concept, and the issue is not listed in CISA's KEV.

What to do: Update the Bitbucket Push and Pull Request Plugin to the latest fixed release, since 4.0.1 and earlier are vulnerable. Until updated, restrict network access to the plugin's webhook endpoint to trusted Bitbucket sources and check logs for outbound connections to unexpected URLs or unusual use of the configured Bitbucket credentials. If compromise is suspected, rotate the Bitbucket credentials stored in Jenkins.