CVE-2026-92139

Executive Summary

CVE-2026-92139 is a server-side request forgery (SSRF) vulnerability (CWE-918) in the Jenkins Bitbucket Push and Pull Request Plugin version 4.0.1 and earlier. The plugin trusts URLs supplied within incoming webhook payloads and subsequently uses configured Jenkins-stored Bitbucket credentials to connect to those attacker-controlled URLs, enabling credential capture. Any organization running a Jenkins controller with this plugin installed and network-reachable webhook endpoints is at risk of exfiltration of Bitbucket credentials used for repository integration. The CVSS base score is 6.5 (Medium), reflecting network-exploitable, low-complexity, no-privilege-required access with limited confidentiality and integrity impact.

Technical Analysis

The vulnerability class is server-side request forgery (CWE-918), specifically a credential-leaking SSRF variant where the vulnerable component does not merely perform an outbound request but attaches stored authentication material to it.

Per the NVD description, the Jenkins Bitbucket Push and Pull Request Plugin (versions 4.0.1 and earlier) "trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs." This describes the following mechanism:

1. Webhook ingestion as the attack surface. The plugin exists to receive webhook events from Bitbucket (push events and pull-request events). A Jenkins controller with this plugin exposes an HTTP endpoint that accepts inbound webhook POSTs. Because webhooks are, by design, machine-to-machine callbacks, these endpoints are typically unauthenticated at the HTTP layer — the plugin must accept the payload without an interactive user login.

2. Trust boundary violation. The plugin treats URLs contained in the webhook payload as trusted input. Instead of validating that the destination host belongs to Bitbucket (e.g., by allow-listing the legitimate Bitbucket API/domain, enforcing scheme restrictions, or rejecting private/reserved address ranges), it accepts the attacker-supplied value as the connection target.

3. Credential attachment. Jenkins has been configured with Bitbucket credentials (the credential objects the plugin uses to authenticate to Bitbucket). When the plugin connects to the attacker-supplied URL, it does so while carrying those configured credentials. This is the critical differentiator from a "standard" SSRF: the outbound request is not only attacker-directed but is also authenticated with a secret the attacker does not possess.

4. Credential capture. Because the attacker controls the destination URL, they control the receiving server. The credential material transmitted by Jenkins (header values, tokens embedded in the request, or authentication exchanges completed against the attacker endpoint) is received and can be recorded. This yields attacker access to the Bitbucket credentials stored in Jenkins.

Because the NVD description does not enumerate the exact payload field name, the precise authentication header used, or the exact plugin endpoint path, those implementation details cannot be asserted and are deliberately not fabricated here. What is derivable and sufficient for detection is the behavioral signature: a Jenkins-to-attacker outbound HTTP(S) connection triggered by a webhook receipt, where the destination is not a legitimate Bitbucket host.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates:

• AV:N — exploitable across a network; the webhook endpoint is remotely reachable.
• AC:L — no special conditions beyond sending a crafted payload.
• PR:N — no authentication or account on Jenkins required.
• UI:N — no victim interaction needed; the payload is processed automatically.
• S:U — impact is scoped to the Jenkins component.
• C:L — limited confidentiality impact, consistent with capture of a bounded set of stored credentials.
• I:L — limited integrity impact, consistent with an outbound request being redirected/forged.
• A:N — no direct availability impact.

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE. No evidence of in-the-wild exploitation is available, and the CVE is not listed in CISA KEV.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (credential-leaking SSRF via untrusted webhook URL) and the NVD description, and deliberately avoids asserting unverified function names, endpoints, or parameter names.

1) Reconnaissance and target identification. An attacker identifies Jenkins controllers running the Jenkins Bitbucket Push and Pull Request Plugin at version 4.0.1 or earlier. Indicators include a reachable Jenkins instance (HTTP title "Jenkins") and the presence of the plugin's webhook listener. Because the plugin is installed to receive Bitbucket webhooks, the corresponding inbound endpoint is reachable from the Internet in many deployments — the attacker needs only the controller's base URL and the webhook endpoint path that the plugin exposes.

2) Triggering the flaw. The attacker sends a crafted HTTP POST to the plugin's webhook endpoint. The payload is crafted to resemble a legitimate Bitbucket push or pull-request event, but the URL value(s) the plugin will use as a connection target are replaced with attacker-controlled URLs (e.g., a host owned by the attacker). No Jenkins authentication is required (PR:N), and no victim interaction is required (UI:N) — the plugin processes the payload upon receipt.

3) Execution at the vulnerability-class level. Acting on the untrusted URL, the plugin initiates an outbound connection from the Jenkins controller to the attacker-supplied destination while using the configured Bitbucket credentials. This is the SSRF primitive: the server makes the request, so the destination sees traffic originating from the Jenkins host and its network position, bypassing any client-side egress restrictions the attacker themselves would face.

4) Post-exploitation impact. The attacker's receiving server records the credential material presented by Jenkins. Because those credentials are the ones configured in Jenkins for Bitbucket integration, the attacker obtains the ability to authenticate to Bitbucket as that integration identity — enabling repository access consistent with the credential's scope, modification of repository content, or use of the credential as a pivot into further integrated systems. The limited (L) confidentiality and integrity subscores reflect the bounded nature of credential capture, but the downstream blast radius depends entirely on the privileges of the captured credential.

Notably, because the outbound request originates from inside the Jenkins network, the attacker also gains an SSRF reconnaissance capability: responses from internal-only endpoints could potentially be observed depending on how the plugin handles and surfaces connection outcomes.

Impact Assessment

Affected systems. Jenkins controllers (and any deployment acting as a Jenkins controller) running the Jenkins Bitbucket Push and Pull Request Plugin at version 4.0.1 or earlier, where the plugin is configured with Bitbucket credentials and its webhook endpoint is reachable by untrusted parties.

Business impact. The primary impact is unauthorized disclosure of Bitbucket credentials stored in Jenkins. Since these credentials are integration secrets, their exposure can translate into unauthorized access to source code repositories, the ability to push or tamper with code (a software supply-chain risk), and potential lateral movement into any systems trusting that identity. The C:L and I:L subscores bound the immediate, per-invocation impact to limited confidentiality/integrity, but the real-world consequence scales with the permissions of the exposed credential — a high-privilege CI/CD credential can have severe downstream consequences.

Blast radius. Scope is unchanged (S:U), meaning the direct impact is confined to the vulnerable Jenkins component; however, captured credentials are reusable externally, which is precisely where the risk extends beyond the component. Organizations that expose Jenkins controllers directly to the Internet, or that permit arbitrary outbound egress from the controller, face the greatest exposure.

Exploitability. With AV:N/AC:L/PR:N/UI:N, the vulnerability is trivially reachable and requires no privileges or user interaction. No public exploit exists, which currently suppresses exploitation likelihood — but the low technical barrier means the flaw is attractive for targeted credential-theft campaigns against CI/CD infrastructure once details become widely understood.

Detection Guidance

Sigma Rule

title: Jenkins Bitbucket Push and Pull Request Plugin SSRF Credential Exfiltration Attempt
id: 7f3a1c92-4b6e-4d1e-9c2a-2f8b6e0a91d4
status: experimental
description: Detects inbound webhook requests to the Jenkins Bitbucket Push and Pull Request Plugin
  that carry URL values pointing outside expected Bitbucket domains, consistent with CVE-2026-92139
  credential-leaking SSRF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92139
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.92139
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/bitbucket-push-and-pull-request'
  selection_payload:
    cs-uri-query|contains:
      - 'url='
      - 'link='
      - 'href='
  filter_legit_bitbucket:
    cs-uri-query|contains:
      - 'bitbucket.org'
      - 'api.bitbucket.org'
      - 'localhost'
      - '127.0.0.1'
  condition: selection_endpoint and selection_payload and not filter_legit_bitbucket
falsepositives:
  - Legitimate webhooks from self-hosted Bitbucket Server instances
  - Custom internal Bitbucket mirrors
level: medium

YARA Rule

rule CVE_2026_92139_Jenkins_Bitbucket_SSRF_Webhook
{
    meta:
        author = "valtersit.com"
        description = "Detects crafted webhook payloads targeting Jenkins Bitbucket Push and Pull Request Plugin SSRF (CVE-2026-92139)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92139"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $plugin = "bitbucket-push-and-pull-request" ascii nocase
        $bbpush = "push" ascii nocase
        $bbpr   = "pullrequest" ascii nocase
        $url1   = "\"url\":" ascii nocase
        $url2   = "\"link\":" ascii nocase
        $href   = "\"href\":" ascii nocase
        $scheme = "http://" ascii nocase
        $scheme2 = "https://" ascii nocase

    condition:
        uint16(0) == 0x4F50 or uint16(0) == 0x7B22 or $plugin
        and any of ($url1, $url2, $href)
        and any of ($scheme, $scheme2)
        and any of ($bbpush, $bbpr)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92139 Jenkins Bitbucket Plugin SSRF Webhook Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"bitbucket-push-and-pull-request"; nocase; http.request_body; content:"url"; nocase; pcre:"/https?:\/\/(?!(api\.)?bitbucket\.org)[^\"\s]+/Ri"; reference:cve,2026-92139; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92139; classtype:attempted-admin; sid:202692139; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "POST" and
     url.path contains "bitbucket-push-and-pull-request"]
  [network where
     destination.domain != null and
     not destination.domain : ("bitbucket.org", "api.bitbucket.org", "localhost") and
     process.name : ("java", "jenkins")]

Splunk SPL Query

index=web OR index=proxy
| eval payload = coalesce(uri_query, request_body, url)
| where (uri_path LIKE "%bitbucket-push-and-pull-request%" OR url LIKE "%bitbucket-push-and-pull-request%")
| where match(payload, "(?i)https?://") 
| where NOT match(payload, "(?i)(api\.)?bitbucket\.org|localhost|127\.0\.0\.1")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by dest_host, uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="jenkins,web,ssrf,">
  <rule id="202692" level="10">
    <decoded_as>json</decoded_as>
    <field name="url.path">bitbucket-push-and-pull-request</field>
    <description>CVE-2026-92139: Possible Jenkins Bitbucket Push and Pull Request Plugin SSRF webhook attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92139,</group>
  </rule>

  <rule id="202693" level="12">
    <if_sid>202692</if_sid>
    <field name="url.query" negate="no">https?://</field>
    <field name="url.query" negate="yes">bitbucket.org</field>
    <description>CVE-2026-92139: Webhook payload URL points outside Bitbucket - likely credential-leaking SSRF.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92139,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version is currently available from the tracked sources. AFFECTED_VERSION is "<= 4.0.1"; do not assume any fixed version exists until the vendor advisory confirms one.

1) Immediate mitigations

• Restrict reachability of the webhook endpoint. Do not expose the Jenkins controller or the plugin's webhook listener directly to the Internet. Place Jenkins behind a reverse proxy or an allow-listed ingress that only permits inbound webhook traffic from trusted Bitbucket source IP ranges.
• Disable the plugin if not in active use. If the Jenkins Bitbucket Push and Pull Request Plugin is not operationally required, disable or uninstall it to remove the attack surface entirely.
• Validate webhook source authenticity at the network/perimeter layer. Enforce IP allow-listing and, where the plugin/provider supports it, cryptographically validate incoming webhook requests before they reach Jenkins.
• Constrain outbound egress. Apply egress firewall rules on the Jenkins controller so it can only initiate connections to expected destinations (e.g., legitimate Bitbucket hosts). This breaks the credential-leaking SSRF even if a crafted payload is accepted, because the attacker-directed connection cannot be established.
• Reduce credential privilege. Ensure the Bitbucket credentials configured in Jenkins are scoped to the minimum required permissions, limiting the impact if they are captured.
• Rotate potentially exposed credentials. If a crafted webhook may have been received, treat stored Bitbucket credentials as compromised and rotate them.

2) Patch/upgrade steps

• Monitor the Jenkins security advisories page and the plugin's update center for a fixed release. There is currently no patch; do not deploy "fixed" versions unless confirmed by the vendor.
• Once a fixed plugin version is published, upgrade the plugin via Jenkins Plugin Manager (or the update center), then restart the controller as required.
• After upgrading, re-validate webhook ingestion and re-apply the egress and ingress restrictions above as defense-in-depth.

3) Long-term hardening

• Treat CI/CD controllers as high-value assets: network-isolate them, avoid direct Internet exposure, and require authenticated, source-validated access to any webhook endpoints.
• Adopt default-deny egress policies for build infrastructure to prevent SSRF-to-credential-theft patterns generally.
• Inventory and minimize secrets stored in Jenkins; prefer short-lived, narrowly scoped credentials and rotate them on a schedule.
• Apply the general SSRF hardening pattern at the plugin/proxy level: allow-list permitted destination hosts and reject private/reserved address ranges for any URL accepted from external input.
• Maintain a software bill of materials for Jenkins plugins and subscribe to Jenkins security advisories to shorten response time for future plugin vulnerabilities.

References

• NVD — CVE-2026-92139: https://nvd.nist.gov/vuln/detail/CVE-2026-92139
• Jenkins Security Advisories (monitor for the fixed plugin version): https://www.jenkins.io/security/advisories/
• Jenkins Plugin Index — Bitbucket Push and Pull Request Plugin (version history/updates): https://plugins.jenkins.io/bitbucket-push-and-pull-request/
• MITRE CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild / threat actor note: No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-92139, and the CVE is not listed in CISA KEV. No known threat actor campaigns or confirmed in-the-wild exploitation evidence exists at the time of writing. No EPSS score has been published by FIRST.org.