Jenkins Jenkins Jenkins CI / CD Server

  1. Vendors
  2. Jenkins

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Jenkins product.

RSS Feeds for Jenkins security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Jenkins products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Jenkins Sorted by Most Security Vulnerabilities since 2018

Jenkins369 vulnerabilities
Continuous Integration Engine

Jenkins Pipeline34 vulnerabilities

Jenkins Openid Connect Authentication7 vulnerabilities

Jenkins Credentials Binding6 vulnerabilities

Jenkins Html Publisher6 vulnerabilities

Jenkins Delphix5 vulnerabilities

Jenkins Credentials5 vulnerabilities

Jenkins Matrix Project5 vulnerabilities

Jenkins Wso2 Oauth5 vulnerabilities

Jenkins Git Parameter5 vulnerabilities

Jenkins Cadence Vmanager5 vulnerabilities

Jenkins Appspider4 vulnerabilities

Jenkins Subversion Partial Release Manager4 vulnerabilities

Jenkins Github Branch Source4 vulnerabilities

Jenkins Health Advisor By Cloudbees4 vulnerabilities

Jenkins Katalon4 vulnerabilities

Jenkins Compuware Topaz For Total Test4 vulnerabilities

Jenkins Icescrum4 vulnerabilities

Recent Jenkins Security Advisories

Advisory Title Published
2026-09-16 Jenkins Security Advisory 2026-09-16 September 16, 2026
2026-09-02 Jenkins Security Advisory 2026-09-02 September 2, 2026
2026-08-05 Jenkins Security Advisory 2026-08-05 August 5, 2026
2026-06-24 Jenkins Security Advisory 2026-06-24 June 24, 2026
2026-06-10 Jenkins Security Advisory 2026-06-10 June 10, 2026
2026-05-27 Jenkins Security Advisory 2026-05-27 May 27, 2026
2026-04-29 Jenkins Security Advisory 2026-04-29 April 29, 2026
2026-03-18 Jenkins Security Advisory 2026-03-18 March 18, 2026
2026-02-18 Jenkins Security Advisory 2026-02-18 February 18, 2026
2025-12-10 Jenkins Security Advisory 2025-12-10 December 10, 2025

Known Exploited Jenkins Vulnerabilities

The following Jenkins vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title Description Added
Jenkins Remote Code Execution Vulnerability Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
CVE-2017-1000353 Exploit Probability: 99.7% 		October 2, 2025
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
CVE-2024-23897 Exploit Probability: 100.0% 		August 19, 2024
Jenkins User Interface (UI) Information Disclosure Vulnerability Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
CVE-2015-5317 Exploit Probability: 23.0% 		May 12, 2023
Jenkins Script Security Plugin Sandbox Bypass Vulnerability Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
CVE-2019-1003029 Exploit Probability: 73.9% 		April 25, 2022
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
CVE-2019-1003030 Exploit Probability: 96.9% 		March 25, 2022
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability A code execution vulnerability exists in the Stapler web framework used by Jenkins
CVE-2018-1000861 Exploit Probability: 98.3% 		February 10, 2022

Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. The vulnerability CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability is in the top 5% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 141 vulnerabilities in Jenkins with an average score of 6.0 out of ten. Last year, in 2025 Jenkins had 91 security vulnerabilities published. That is, 50 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.48.




Year Vulnerabilities Average Score
2026 141 6.01
2025 91 5.54
2024 32 6.18
2023 255 6.36
2022 389 6.16
2021 102 6.51
2020 228 6.00
2019 345 6.88
2018 120 6.45

It may take a day or so for new Jenkins vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Jenkins Security Vulnerabilities

CVE Date Vulnerability Products
CVE-2026-92141 Sep 16, 2026
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
Jenkins
CVE-2026-92140 Sep 16, 2026
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
Jenkins
CVE-2026-92139 Sep 16, 2026
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
Jenkins
CVE-2026-92138 Sep 16, 2026
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.
Jenkins
CVE-2026-92137 Sep 16, 2026
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution.
Jenkins
CVE-2026-92136 Sep 16, 2026
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins
CVE-2026-92135 Sep 16, 2026
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins
CVE-2026-92134 Sep 16, 2026
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins
CVE-2026-92133 Sep 16, 2026
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.
Jenkins
CVE-2026-92131 Sep 16, 2026
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.
Jenkins
CVE-2026-92132 Sep 16, 2026
Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.
Jenkins
CVE-2026-92130 Sep 16, 2026
Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Jenkins
CVE-2026-92129 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox.
Jenkins
CVE-2026-92128 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Jenkins
CVE-2026-92127 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Jenkins
CVE-2026-92126 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.
Jenkins
CVE-2026-92125 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM.
Jenkins
CVE-2026-92124 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Jenkins
CVE-2026-92123 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses) Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Jenkins
CVE-2026-92122 Sep 16, 2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Jenkins
CVE-2026-84677 Sep 02, 2026
Jenkins Update-2 XSS via Unescaped Plugin Metadata (3.18.3) Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
CVE-2026-84676 Sep 02, 2026
Jenkins Param Remote Trigger Plugin <=3.2.2 Exposes Unencrypted Tokens Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Jenkins
CVE-2026-84675 Sep 02, 2026
Jenkins TICS Plugin OS Command Injection via Build Env (before 2025.1.1) OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.
Jenkins
CVE-2026-84674 Sep 02, 2026
Jenkins XebiaLabs XL Deploy Plugin 26.1.0 Missing Permission Checks Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Jenkins
CVE-2026-84673 Sep 02, 2026
Jenkins Customizable Header Plugin XSS via Stapler Data Binding Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins
CVE-2026-84672 Sep 02, 2026
Jenkins Entra Plugin Group DN Collision Grants Privileged Access Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.
Jenkins
CVE-2026-84671 Sep 02, 2026
Jenkins FP Plugin Arbitrary File Write via Stapler Binding Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.
Jenkins
CVE-2026-84670 Sep 02, 2026
Jenkins Perf. Plugin RCE via unrestricted deserialization Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
Jenkins
CVE-2026-84669 Sep 02, 2026
Jenkins Allure Plugin <=2.35.2 Path Traversal (CVE-2026-84669) A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.
Jenkins
CVE-2026-84668 Sep 02, 2026
Jenkins SAML Plugin <=4.618: Metadata file overwrite via Stapler Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
Jenkins
CVE-2026-84667 Sep 02, 2026
Jenkins ThinBackup Plugin <2.1.4: Config Overwrite via Stapler Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.
Jenkins
CVE-2026-84666 Sep 02, 2026
Jenkins Job Config History Plugin: Overwrite Config via Stapler Data Binding Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.
Jenkins
CVE-2026-84665 Sep 02, 2026
Stored XSS via javascript: in Jenkins SonarQube Scanner Plugin <=2.18.3 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins
CVE-2026-84664 Sep 02, 2026
Jenkins GitLab Plugin <=1.9.16 Global Config Overwrite via Stapler Data Binding Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.
Jenkins
CVE-2026-84663 Sep 02, 2026
CSRF in Jenkins Pipeline Groovy Libraries Plugin deletes shared library caches A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.
Jenkins
CVE-2026-84662 Sep 02, 2026
Jenkins LDAP Plugin <=807.809: URL Connect via Stapler Data Binding Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL.
Jenkins
CVE-2026-84661 Sep 02, 2026
Jenkins Build Step Plugin: propagateAbort Permission Check Bypass A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Jenkins
CVE-2026-84660 Sep 02, 2026
Jenkins Pipeline Build Step Plugin Missing Permission Check A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Jenkins
CVE-2026-84659 Sep 02, 2026
Jenkins ScriptSec Plugin: sandbox bypass via missing permission check Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
Jenkins
CVE-2026-84658 Sep 02, 2026
Jenkins Script Security Plugin @DataBoundConstructor config read vulnerability Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
Jenkins
CVE-2026-84657 Sep 02, 2026
Jenkins 2.579 LTS: Build CLI -s Bypasses Item/Cancel Perm (CVE-2026-84657) In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users.
Jenkins
CVE-2026-84656 Sep 02, 2026
Missing Permission Check in Jenkins 2.579/LTS 2.568.2: Unauthorized Job Parameter View A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.
Jenkins
CVE-2026-84654 Sep 02, 2026
Jenkins Stapler <2107 (except 2088.2093) allows global config via form In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.
Jenkins
CVE-2026-84655 Sep 02, 2026
Jenkins <=2.579 LTS <=2.568.2 JSON Map Key Injection via REST API Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.
Jenkins
CVE-2026-84652 Sep 02, 2026
Jenkins Session Fixation via RememberMe Cookie (up to 2.579) In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
Jenkins
CVE-2026-84653 Sep 02, 2026
Jenkins 2.421-2.579 LTS 2.426.1-2.568.2: Overall/Manage Can Alter Appearance Config Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
Jenkins
CVE-2026-84651 Sep 02, 2026
Jenkins API Agent Config Overwrite CVE-2026-84651 (2.579, 2.568.2) In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.
Jenkins
CVE-2026-84650 Sep 02, 2026
Jenkins 2.579 & LTS 2.568.2 Transient Field Deserialization Weakness In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.
Jenkins
CVE-2026-84649 Sep 02, 2026
Jenkins Stapler CSRF Token Leak 2.447-2.579 via SameSite JS In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
Jenkins
CVE-2026-84648 Sep 02, 2026
Jenkins System Log Viewer XSS before 2.579 / LTS 2.568.2 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
Jenkins
Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.