A cross‑site request forgery flaw in the Jenkins GitHub Integration Plugin allows an attacker to trigger an unintended build for a pull request. The weakness enables a malicious actor to execute build jobs without legitimate authorization, potentially exposing internal resources or introducing unauthorized code changes. The vulnerability is classic CSRF, identified by CWE-352.

Jenkins Project Jenkins GitHub Integration Plugin versions 0.7.3 and earlier are affected. All installations of that plugin running at or below these versions are vulnerable.

The CVSS score of 4.3 indicates moderate risk overall. EPSS data is not available to gauge current exploitation likelihood, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be CSRF, meaning an attacker could send a crafted request from a user’s browser or a malicious script that bypasses Jenkins’ CSRF token checks. Successful exploitation would require that the victim has network access to the Jenkins instance and does not have additional mitigation such as trained access controls or reverse proxy filtering.