CVE-2019-1003010: Jenkins Git

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.

Affected products

• Jenkins Git: up to and including 3.9.1
• Red Hat Openshift Container Platform: version 3.11 only

Published 2019-02-06. Last modified 2026-06-17.