jenkins vulnerabilities

Products

• jenkins 295
• script security 45
• pipeline groovy 14
• active directory 12
• blue ocean 11
• email extension 11
• git 11
• build failure analyzer 9
• config file provider 9
• configuration as code 9
• credentials binding 8
• github branch source 8
• ns-nd integration performance publisher 8
• html publisher 7
• job configuration history 7
• kubernetes 7
• openid 7
• openid connect authentication 7
• openshift deployer 7
• pipelineshared groovy libraries 7
• rundeck 7
• subversion 7
• amazon ec2 6
• azure ad 6
• azure vm agents 6
• deployment dashboard 6
• electricflow 6
• gerrit trigger 6
• git client 6
• git parameter 6

Latest jenkins CVEs

Newest publication first · page 1 of 40 · showing the latest 1,000

1. CVE-2026-117624 jenkins: Jenkins: Root element check bypass via nested object deserialization

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.39%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element ch...

2. CVE-2026-117623 jenkins: Jenkins: Stored cross-site scripting via unescaped breadcrumb bar tooltips

   Published 2026-10-28

   Medium·CVSS 5.4 EPSS 0.27%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

3. CVE-2026-117621 jenkins: Jenkins: Cross-site scripting via workspace browser link computation on agents

   Published 2026-10-28

   Medium·CVSS 6.1 EPSS 0.29%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

4. CVE-2026-117622 jenkins: Jenkins: Cross-site scripting via agent HTTP response exceptions

   Published 2026-10-28

   Medium·CVSS 6.1 EPSS 0.29%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

5. CVE-2026-117619 jenkins: Jenkins: Unauthorized persistent access via 'remember me' cookie generation

   Published 2026-10-28

   High·CVSS 8.1 EPSS 0.32%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember m...

6. CVE-2026-117620 jenkins: jenkins: Privilege escalation via Manage Old Data feature

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.41%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including...

7. CVE-2026-117618 jenkins: Jenkins: Unauthorized administrator account creation via setup wizard race condition

   Published 2026-10-28

   High·CVSS 8.1 EPSS 0.26%

   In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while th...

8. CVE-2026-117617 jenkins: Jenkins: Arbitrary file write via race condition in artifact extraction

   Published 2026-10-28

   High·CVSS 8.1 EPSS 0.48%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, all...

9. CVE-2026-117616 jenkins: Jenkins: Arbitrary code execution via path traversal in agent names

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.61%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrit...

10. CVE-2026-117615 jenkins: jenkins: Arbitrary file read via symbolic link following during item rename

    Published 2026-10-28

    Medium·CVSS 6.5 EPSS 0.43%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

11. CVE-2026-117614 jenkins: jenkins: Arbitrary code execution via legacy agent launch command conversion

    Published 2026-10-28

    High·CVSS 8.8 EPSS 0.40%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure...

12. CVE-2026-117613 jenkins: Jenkins: Stored cross-site scripting via improper collection element deserialization

    Published 2026-10-28

    Medium·CVSS 5.4 EPSS 0.29%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulne...

13. CVE-2026-117612 jenkins: Jenkins: Remote code execution via resolves-to attribute handling in XStream

    Published 2026-10-28

    High·CVSS 8.8 EPSS 0.41%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the resolves-to attribute during XStream deserialization.

14. CVE-2026-92129 jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leads to arbitrary code execution

    Published 2026-09-16

    High·CVSS 7.5 EPSS 0.48%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox prot...

15. CVE-2026-92127 Jenkins Script Security Plugin: Jenkins Script Security Plugin: Arbitrary code execution via automatic classpath entry approval

    Published 2026-09-16

    High·CVSS 8.0 EPSS 0.61%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers abl...

16. CVE-2026-92128 Jenkins Script Security Plugin: Jenkins Script Security Plugin: Arbitrary code execution via double JAR file download

    Published 2026-09-16

    High·CVSS 7.5 EPSS 0.29%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary...

17. CVE-2026-92125 org.jenkins-ci.plugins/script-security: Jenkins Script Security Plugin: Arbitrary code execution via Groovy AST transformation bypass

    Published 2026-09-16

    High·CVSS 8.8 EPSS 0.56%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypa...

18. CVE-2026-92126 Jenkins Script Security Plugin: Jenkins Script Security Plugin: Sandbox bypass via @Builder annotations

    Published 2026-09-16

    High·CVSS 8.5 EPSS 0.62%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sa...

19. CVE-2026-92124 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type bu...

    Published 2026-09-16

    High·CVSS 8.8 EPSS 0.63%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission...

20. CVE-2026-92123 jenkins-script-security-plugin: org.jenkins-ci.plugins/script-security: jenkins-plugin/script-security: Jenkins Script Security Plugin: Arbitrary code execution via sandbox bypass

    Published 2026-09-16

    High·CVSS 8.8 EPSS 0.63%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipel...

21. CVE-2026-92122 Jenkins Script Security Plugin: Jenkins Script Security Plugin: Arbitrary code execution via sandbox bypass

    Published 2026-09-16

    High·CVSS 8.8 EPSS 0.63%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with per...

22. CVE-2026-84659 jenkins-script-security-plugin: Jenkins Script Security Plugin: Security sandbox bypass via missing permission check

    Published 2026-09-02

    Medium·CVSS 4.3 EPSS 0.28%

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

23. CVE-2026-84658 Jenkins Script Security Plugin: Jenkins Script Security Plugin: Information disclosure via form submission

    Published 2026-09-02

    Medium·CVSS 4.3 EPSS 0.31%

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.

24. CVE-2026-84656 jenkins: Jenkins: Information disclosure via missing permission check

    Published 2026-09-02

    Medium·CVSS 4.3 EPSS 0.46%

    A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

25. CVE-2026-84657 jenkins: Jenkins: Unauthorized build cancellation via CLI command

    Published 2026-09-02

    Medium·CVSS 4.2 EPSS 0.39%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.