What is CVE-2026-92132?

CVE-2026-92132 is a medium-severity vulnerability in Jenkins Project Gradle Plugin, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 5.4/10. Published 2026-09-16.

How severe is CVE-2026-92132?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Jenkins Project Gradle Plugin

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Jenkins Project Gradle Plugin

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

jenkinsci-cert@googlegroups.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-92132?: CVE-2026-92132 is a medium-severity vulnerability in Jenkins Project Gradle Plugin, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 5.4/10. Published 2026-09-16.
How severe is CVE-2026-92132?: Medium severity. CVSS v3 base score is 5.4 out of 10.