Jenkins
1822 CVEs across 714 Jenkins products. Browse Jenkins vulnerabilities, severities, and proof-of-concept exploits.
Jenkins products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92129 | High | 7.5 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime… |
CVE-2026-92128 | High | 7.5 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and… |
CVE-2026-92127 | High | 8.0 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall… |
CVE-2026-92126 | High | 8.5 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, al… |
CVE-2026-92125 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permissi… |
CVE-2026-92124 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a… |
CVE-2026-92123 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribu… |
CVE-2026-92122 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a v… |
CVE-2026-84659 | Medium | 4.3 | 2026-09-02 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbo… |
CVE-2026-84658 | Medium | 4.3 | 2026-09-02 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configur… |
CVE-2026-84657 | Medium | 4.2 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build… |
CVE-2026-84656 | Medium | 4.3 | 2026-09-02 | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build p… |
CVE-2026-84655 | Medium | 4.3 | 2026-09-02 | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attacker… |
CVE-2026-84653 | Low | 3.5 | 2026-09-02 | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance confi… |
CVE-2026-84652 | High | 7.3 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing… |
CVE-2026-84651 | Medium | 6.3 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration… |
CVE-2026-84650 | High | 8.8 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuratio… |
CVE-2026-84648 | High | 8.8 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a… |
CVE-2026-84646 | Medium | 4.3 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers wit… |
CVE-2026-84645 | High | 8.8 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in J… |
CVE-2026-70430 | Low | 2.7 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy confi… |
CVE-2026-70429 | Medium | 6.5 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create n… |
CVE-2026-70428 | Medium | 4.3 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with… |
CVE-2026-70427 | Medium | 4.3 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar… |
CVE-2026-57307 | Medium | 4.2 | 2026-06-24 | A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an a… |
CVE-2026-57306 | Medium | 4.2 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacke… |
CVE-2026-57305 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an… |
CVE-2026-57304 | Medium | 5.4 | 2026-06-24 | A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usi… |
CVE-2026-57303 | High | 7.1 | 2026-06-24 | Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the… |
CVE-2026-57302 | Medium | 4.3 | 2026-06-24 | Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with… |
CVE-2026-57301 | High | 8.8 | 2026-06-24 | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Con… |
CVE-2026-57300 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay… |
CVE-2026-57299 | Medium | 4.3 | 2026-06-24 | Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate… |
CVE-2026-57297 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect… |
CVE-2026-57295 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-s… |
CVE-2026-57294 | Medium | 5.4 | 2026-06-24 | A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2026-57290 | Medium | 4.3 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job… |
CVE-2026-57289 | Medium | 4.8 | 2026-06-24 | Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending B… |
CVE-2026-57288 | Low | 3.7 | 2026-06-24 | Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentica… |
CVE-2026-57287 | Medium | 4.3 | 2026-06-24 | Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and ag… |
CVE-2026-57286 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information abou… |
CVE-2026-57285 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain t… |
CVE-2026-57284 | Medium | 4.3 | 2026-06-24 | Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, all… |
CVE-2026-57283 | Medium | 4.3 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types relat… |
CVE-2026-57282 | Medium | 5.0 | 2026-06-24 | Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, all… |
CVE-2026-57281 | High | 7.5 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing att… |
CVE-2026-57280 | High | 8.8 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in san… |
CVE-2026-53442 | Medium | 5.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencryp… |
CVE-2026-53441 | Medium | 5.4 | 2026-06-10 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline c… |
CVE-2026-53440 | Medium | 4.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to r… |
CVE-2026-53439 | Medium | 4.3 | 2026-06-10 | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configur… |
CVE-2026-53438 | Medium | 4.3 | 2026-06-10 | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission… |
CVE-2026-53437 | Medium | 4.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains t… |
CVE-2026-53436 | Medium | 4.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains r… |
CVE-2026-53435 | High | 8.8 | 2026-06-10 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plug… |
CVE-2026-9674 | Medium | 4.3 | 2026-05-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds. |
CVE-2026-48927 | Medium | 5.5 | 2026-05-27 | Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by att… |
CVE-2026-48926 | Medium | 4.3 | 2026-05-27 | Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permiss… |
CVE-2026-48924 | Medium | 4.3 | 2026-05-27 | Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
CVE-2026-48923 | Medium | 4.3 | 2026-05-27 | Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2026-48922 | High | 7.5 | 2026-05-27 | Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers a… |
CVE-2026-48921 | High | 7.5 | 2026-05-27 | Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to co… |
CVE-2026-48920 | High | 8.8 | 2026-05-27 | Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, witho… |
CVE-2026-48919 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-48918 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. |
CVE-2026-48917 | Medium | 6.6 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-48916 | Medium | 6.6 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. |
CVE-2026-42525 | Medium | 4.3 | 2026-04-29 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to per… |
CVE-2026-42524 | High | 8.0 | 2026-04-29 | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2026-42523 | Critical | 9.0 | 2026-04-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook tri… |
CVE-2026-42522 | Medium | 4.3 | 2026-04-29 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect t… |
CVE-2026-42521 | Medium | 6.5 | 2026-04-29 | Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration… |
CVE-2026-42520 | High | 7.5 | 2026-04-29 | Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to pr… |
CVE-2026-42519 | Medium | 4.3 | 2026-04-29 | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending… |
CVE-2026-33004 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to ob… |
CVE-2026-33003 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by us… |
CVE-2026-33002 | High | 7.5 | 2026-03-18 | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebS… |
CVE-2026-33001 | High | 8.8 | 2026-03-18 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted a… |
CVE-2026-27100 | Medium | 4.3 | 2026-02-18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, all… |
CVE-2026-27099 | High | 8.0 | 2026-02-18 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporari… |
CVE-2025-67643 | Medium | 4.3 | 2025-12-10 | Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory whi… |
CVE-2025-67642 | Medium | 4.3 | 2025-12-10 | Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/… |
CVE-2025-67641 | Medium | 5.4 | 2025-12-10 | Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when sub… |
CVE-2025-67640 | Medium | 5.0 | 2025-12-10 | Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell scrip… |
CVE-2025-67639 | Low | 3.5 | 2025-12-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the… |
CVE-2025-67638 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential f… |
CVE-2025-67637 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they c… |
CVE-2025-67636 | Medium | 4.3 | 2025-12-10 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values i… |
CVE-2025-67635 | High | 7.5 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing un… |
CVE-2025-64150 | Medium | 5.4 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2025-64149 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2025-64148 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-64147 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and c… |
CVE-2025-64146 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with It… |
CVE-2025-64145 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe… |
CVE-2025-64144 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wi… |
CVE-2025-64143 | Medium | 4.3 | 2025-10-29 | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can b… |
CVE-2025-64142 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2025-64141 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2025-64140 | High | 8.8 | 2025-10-29 | Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permiss… |