CVE-2026-57289

score

<0.1

cvss

4.8

epss

0.2%

published

2026-06-24

kev added

—

first seen

2026-10-21

Jenkins Bitbucket Push and Pull Request Plugin <= 3.3.8 contains a weak cryptography vulnerability caused by unconditional disabling of SSL/TLS certificate and hostname validation for Bearer token authenticated requests, letting attackers intercept network traffic and capture tokens, exploit requires network interception capability.