Jenkins Project Jenkins
125 CVEs affecting Jenkins Project Jenkins. Latest disclosed: 2026-08-10. Critical: 13, High: 33.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23897 | Critical | 9.8 | 2024-01-24 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path… |
CVE-2021-21696 | Critical | 9.8 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePa… |
CVE-2021-21694 | Critical | 9.8 | 2021-11-04 | FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and e… |
CVE-2021-21693 | Critical | 9.8 | 2021-11-04 | When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2… |
CVE-2021-21692 | Critical | 9.8 | 2021-11-04 | FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission… |
CVE-2021-21691 | Critical | 9.8 | 2021-11-04 | Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
CVE-2021-21690 | Critical | 9.8 | 2021-11-04 | Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303… |
CVE-2023-27898 | Critical | 9.6 | 2023-03-10 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when renderi… |
CVE-2021-21697 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restr… |
CVE-2021-21689 | Critical | 9.1 | 2021-11-04 | FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
CVE-2021-21687 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FileP… |
CVE-2021-21685 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. |
CVE-2026-70426 | Critical | 9.0 | 2026-08-05 | In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class f… |
CVE-2026-53435 | High | 8.8 | 2026-06-10 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plug… |
CVE-2026-33001 | High | 8.8 | 2026-03-18 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted a… |
CVE-2024-43044 | High | 8.8 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLo… |
CVE-2024-23898 | High | 8.8 | 2024-01-24 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… |
CVE-2023-43496 | High | 8.8 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created fi… |
CVE-2021-21695 | High | 8.8 | 2021-11-04 | FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 an… |
CVE-2020-2160 | High | 8.8 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassi… |