Jenkins Project vulnerabilities

Products

• Jenkins 152
• Jenkins Script Security Plugin 39
• Jenkins Active Directory Plugin 11
• Jenkins Pipeline: Groovy Plugin 11
• Jenkins Email Extension Plugin 9
• Jenkins Build Failure Analyzer Plugin 8
• Jenkins GitLab Plugin 8
• Jenkins Job Configuration History Plugin 8
• Jenkins NS-ND Integration Performance Publisher Plugin 8
• Jenkins OpenId Connect Authentication Plugin 8
• Jenkins Pipeline: Shared Groovy Libraries Plugin 8
• Jenkins Amazon EC2 Plugin 7
• Jenkins Configuration as Code Plugin 7
• Jenkins Git Plugin 7
• Jenkins OpenShift Deployer Plugin 7
• Jenkins Rundeck Plugin 7
• Jenkins SAML Single Sign On(SSO) Plugin 7
• Jenkins XebiaLabs XL Deploy Plugin 7
• Jenkins Artifactory Plugin 6
• Jenkins Azure VM Agents Plugin 6
• Jenkins Config File Provider Plugin 6
• Jenkins Credentials Binding Plugin 6
• Jenkins Deployment Dashboard Plugin 6
• Jenkins ElectricFlow Plugin 6
• Jenkins Git Parameter Plugin 6
• Jenkins GitLab Authentication Plugin 6
• Jenkins HashiCorp Vault Plugin 6
• Jenkins HTML Publisher Plugin 6
• Jenkins Pipeline Maven Integration Plugin 6
• Jenkins Project Inheritance Plugin 6

Latest Jenkins Project CVEs

Newest publication first · page 1 of 40 · showing the latest 1,000

1. CVE-2026-117626 jenkins: Jenkins: Information disclosure via path traversal in file browser

   Published 2026-10-28

   Medium·CVSS 4.3 EPSS 0.25%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times...

2. CVE-2026-117625 jenkins: jenkins: Information disclosure via missing permission check in HTTP proxy configuration

   Published 2026-10-28

   Medium·CVSS 4.3 EPSS 0.18%

   A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

3. CVE-2026-117624 jenkins: Jenkins: Root element check bypass via nested object deserialization

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.39%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element ch...

4. CVE-2026-117623 jenkins: Jenkins: Stored cross-site scripting via unescaped breadcrumb bar tooltips

   Published 2026-10-28

   Medium·CVSS 5.4 EPSS 0.27%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

5. CVE-2026-117621 jenkins: Jenkins: Cross-site scripting via workspace browser link computation on agents

   Published 2026-10-28

   Medium·CVSS 6.1 EPSS 0.29%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

6. CVE-2026-117622 jenkins: Jenkins: Cross-site scripting via agent HTTP response exceptions

   Published 2026-10-28

   Medium·CVSS 6.1 EPSS 0.29%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

7. CVE-2026-117619 jenkins: Jenkins: Unauthorized persistent access via 'remember me' cookie generation

   Published 2026-10-28

   High·CVSS 8.1 EPSS 0.32%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember m...

8. CVE-2026-117620 jenkins: jenkins: Privilege escalation via Manage Old Data feature

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.41%

   Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including...

9. CVE-2026-117618 jenkins: Jenkins: Unauthorized administrator account creation via setup wizard race condition

   Published 2026-10-28

   High·CVSS 8.1 EPSS 0.26%

   In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while th...

10. CVE-2026-117617 jenkins: Jenkins: Arbitrary file write via race condition in artifact extraction

    Published 2026-10-28

    High·CVSS 8.1 EPSS 0.48%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, all...

11. CVE-2026-117616 jenkins: Jenkins: Arbitrary code execution via path traversal in agent names

    Published 2026-10-28

    High·CVSS 8.8 EPSS 0.61%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrit...

12. CVE-2026-117615 jenkins: jenkins: Arbitrary file read via symbolic link following during item rename

    Published 2026-10-28

    Medium·CVSS 6.5 EPSS 0.43%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

13. CVE-2026-117614 jenkins: jenkins: Arbitrary code execution via legacy agent launch command conversion

    Published 2026-10-28

    High·CVSS 8.8 EPSS 0.40%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure...

14. CVE-2026-117613 jenkins: Jenkins: Stored cross-site scripting via improper collection element deserialization

    Published 2026-10-28

    Medium·CVSS 5.4 EPSS 0.29%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulne...

15. CVE-2026-117612 jenkins: Jenkins: Remote code execution via resolves-to attribute handling in XStream

    Published 2026-10-28

    High·CVSS 8.8 EPSS 0.41%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the resolves-to attribute during XStream deserialization.

16. CVE-2026-92141 Keycloak Authentication Plugin: Jenkins Keycloak Authentication Plugin: Phishing attacks via unrestricted redirect URL

    Published 2026-09-16

    Medium·CVSS 4.3 EPSS 0.33%

    Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

17. CVE-2026-92140 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exp...

    Published 2026-09-16

    Medium·CVSS 6.8 EPSS 0.43%

    Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhoo...

18. CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those UR...

    Published 2026-09-16

    Medium·CVSS 6.5 EPSS 0.25%

    Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sen...

19. CVE-2026-92138 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauth_callback URL from the submitted form rather than from the server-side stored request t...

    Published 2026-09-16

    Medium·CVSS 4.2 EPSS 0.11%

    The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauth_callback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on...

20. CVE-2026-92137 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller...

    Published 2026-09-16

    High·CVSS 8.8 EPSS 0.84%

    Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitra...

21. CVE-2026-92136 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability explo...

    Published 2026-09-16

    High·CVSS 8.0 EPSS 0.41%

    Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

22. CVE-2026-92135 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure pe...

    Published 2026-09-16

    High·CVSS 8.0 EPSS 0.41%

    Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cr...

23. CVE-2026-92134 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configu...

    Published 2026-09-16

    High·CVSS 8.0 EPSS 0.41%

    Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stor...

24. CVE-2026-92133 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omittin...

    Published 2026-09-16

    Medium·CVSS 5.4 EPSS 0.23%

    Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item...

25. CVE-2026-92132 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global c...

    Published 2026-09-16

    Medium·CVSS 5.4 EPSS 0.25%

    Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the De...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.