CVE-2019-1003026

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.

• CWE-918

• http://www.securityfocus.com/bid/107295Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-02-19/#SECURITY-985Vendor Advisory
• http://www.securityfocus.com/bid/107295Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-02-19/#SECURITY-985Vendor Advisory

Published

Feb 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1003020A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003021An exposure of sensitive information vulnerability exists in…
• CVE-2019-1003022A denial of service vulnerability exists in Jenkins Monitori…
• CVE-2019-1003023A cross-site scripting vulnerability exists in Jenkins Warni…
• CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Secu…8.8
• CVE-2019-1003025A exposure of sensitive information vulnerability exists in …8.8
• CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003028A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003029A sandbox bypass vulnerability exists in Jenkins Script Secu…9.9
• CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: G…9.9
• CVE-2019-1003031A sandbox bypass vulnerability exists in Jenkins Matrix Proj…9.9
• CVE-2019-1003032A sandbox bypass vulnerability exists in Jenkins Email Exten…9.9