diff --git a/java/jenkins/webhook/unprotected-readvalue-no-secret.yaml b/java/jenkins/webhook/unprotected-readvalue-no-secret.yaml
new file mode 100644
index 0000000..1e2fb70
--- /dev/null
+++ b/java/jenkins/webhook/unprotected-readvalue-no-secret.yaml
@@ -0,0 +1,65 @@
+rules:
+  - id: codevigilant.java.jenkins.webhook.unprotected-readvalue-no-secret
+    patterns:
+      - pattern-either:
+          - pattern: |
+              class $X implements UnprotectedRootAction {
+                ...
+                public $RET $M(...) {
+                  ...
+                  $MAPPER.readValue($REQ.getInputStream(), $T);
+                  ...
+                }
+              }
+          - pattern: |
+              class $X implements UnprotectedRootAction {
+                ...
+                $RET $M(...) {
+                  ...
+                  $MAPPER.readValue($REQ.getInputStream(), $T);
+                  ...
+                }
+              }
+      - pattern-not: |
+          class $X implements UnprotectedRootAction {
+            ...
+            public $RET $M(...) {
+              ...
+              $REQ.getHeader("X-Hub-Signature");
+              ...
+              $MAPPER.readValue($REQ.getInputStream(), $T);
+              ...
+            }
+          }
+      - pattern-not: |
+          class $X implements UnprotectedRootAction {
+            ...
+            public $RET $M(...) {
+              ...
+              $REQ.getHeader("X-Hub-Signature-256");
+              ...
+              $MAPPER.readValue($REQ.getInputStream(), $T);
+              ...
+            }
+          }
+    message: >-
+      A Jenkins UnprotectedRootAction handler parses the HTTP request body
+      with ObjectMapper.readValue and does not read an HMAC/signature
+      header first. UnprotectedRootAction skips Jenkins authentication;
+      without a shared-secret check anyone who can POST to the endpoint
+      can inject events (CWE-306). Verify a webhook secret (constant-time)
+      before parsing.
+    metadata:
+      category: security
+      cwe: "CWE-306: Missing Authentication for Critical Function"
+      owasp: "A07:2021 - Identification and Authentication Failures"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://cwe.mitre.org/data/definitions/306.html
+        - https://www.jenkins.io/doc/developer/security/csrf-protection/
+      source: semgrep-rule-gap
+      license: MIT
+    languages: [java]
+    mode: search
+    severity: ERROR