Jenkins Project vulnerabilities
Published CVEs affecting Jenkins Project products: 170 record(s), with severity, exploitation and fixes.
Jenkins 36Jenkins Script Security Plugin 14Jenkins Gitee Plugin 4Jenkins LDAP Plugin 3Jenkins Active Directory Plugin 3Jenkins Pipeline: Groovy Libraries Plugin 3Jenkins Multijob Plugin 3Jenkins Publish to Bitbucket Plugin 3Jenkins Pipeline: Groovy Plugin 3Jenkins Assembla Plugin 3Jenkins Contrast Continuous Application Security Plugin 3Jenkins Parameterized Remote Trigger Plugin 2Jenkins SCM-Manager Plugin 2Jenkins Coverage Plugin 2Jenkins Nexus Task Runner Plugin 2Jenkins SAML Plugin 2Jenkins Themis Plugin 2Jenkins Pipeline: Build Step Plugin 2Jenkins Microsoft Entra ID (previously Azure AD) Plugin 2Jenkins LoadNinja Plugin 2Jenkins GitLab Plugin 2Jenkins Zowe zDevOps Plugin 2Jenkins External Workspace Manager Plugin 2Jenkins Credentials Binding Plugin 2Jenkins GitHub Branch Source Plugin 2Jenkins Curseforge Publisher Plugin 2Jenkins MCP Server Plugin 2Jenkins Start Windocks Containers Plugin 2Jenkins ByteGuard Build Actions Plugin 2Jenkins EC2 Fleet Plugin 2Jenkins Git client Plugin 2Jenkins Job Configuration History Plugin 2Jenkins Bitbucket Push and Pull Request Plugin 2Jenkins AWS CodeBuild Plugin 1Jenkins CodeSonar Plugin 1Jenkins Horreum Plugin 1Jenkins Ivy Report Plugin 1Jenkins Priority Sorter Plugin 1Jenkins Sauce OnDemand Plugin 1Jenkins Git Parameter Plugin 1
CVE-2026-70426
Critical · 9.0
CWE-502 Aug 5, 2026
Deserialization of Untrusted Data in Jenkins Project Jenkins
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.
CVE-2026-57307
Medium · 4.2
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Zowe Zdevops
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2026-57306
Medium · 4.2
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Zowe Zdevops
A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2026-57305
Medium · 5.4
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Assembla
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.
CVE-2026-57304
Medium · 5.4
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Assembla
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
CVE-2026-57303
High · 7.1
CWE-918 Jun 24, 2026
Server-Side Request Forgery (SSRF) in Jenkins Assembla
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.
CVE-2026-57302
Medium · 4.3
CWE-256 Jun 24, 2026
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml…
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
CVE-2026-57301
High · 8.8
CWE-610 Jun 24, 2026
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins…
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
CVE-2026-57300
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Mcp Server
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
CVE-2026-57299
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Contrast Continuous Application Security
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
CVE-2026-57298
Medium · 5.4
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Project Jenkins Contrast Continuous Application Security Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
CVE-2026-57297
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Contrast Continuous Application Security
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
CVE-2026-57296
High · 8.8
CWE-22 Jun 24, 2026
Path Traversal in Jenkins Project Jenkins External Workspace Manager Plugin
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.
CVE-2026-57295
Medium · 5.4
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Ec2 Fleet
A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
CVE-2026-57294
Medium · 5.4
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Ec2 Fleet
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
CVE-2026-57293
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Project Jenkins Gitee Plugin
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2026-57292
Medium · 5.4
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Project Jenkins Gitee Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
CVE-2026-57291
Medium · 5.4
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Project Jenkins Gitee Plugin
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
CVE-2026-57290
Medium · 4.3
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Priority Sorter
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
CVE-2026-57289
Medium · 4.8
CWE-295 Jun 24, 2026
Improper Certificate Validation in Jenkins Bitbucket Push And Pull Request
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
CVE-2026-57288
Low · 3.7
CWE-90 Jun 24, 2026
LDAP Injection in Jenkins Active Directory
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
CVE-2026-57287
Medium · 4.3
CWE-312 Jun 24, 2026
Cleartext Storage of Sensitive Information in Jenkins Job Configuration History
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
CVE-2026-57286
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Git Parameter
A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.
CVE-2026-57285
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Github Branch Source
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
CVE-2026-57284
Medium · 4.3
CWE-470 Jun 24, 2026
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the…
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.