The vulnerability in Jenkins Bitbucket Push and Pull Request Plugin (version 3.3.8 and earlier) involves unconditional disabling of SSL/TLS certificate and hostname validation for Bearer token authenticated requests to the configured Bitbucket Server endpoint. This misconfiguration enables attackers with network interception capabilities to capture the Bearer token, potentially compromising authentication and access to the Bitbucket Server.

Attackers able to intercept network traffic between Jenkins and the Bitbucket Server can capture Bearer tokens used for authentication. This exposure can lead to unauthorized access to Bitbucket resources using the stolen token. The vulnerability undermines the confidentiality and integrity of the authentication process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected plugin versions or ensure network traffic is protected by other means such as VPN or network segmentation to prevent interception. Monitor official Jenkins Project advisories for updates and apply patches promptly once released.