Jenkins Jenkins Jenkins CI / CD Server

  1. Vendors
  2. Jenkins

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Jenkins product.

RSS Feeds for Jenkins security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Jenkins products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Jenkins Sorted by Most Security Vulnerabilities since 2018

Jenkins233 vulnerabilities
Continuous Integration Engine

Jenkins Pipeline34 vulnerabilities

Jenkins Openid Connect Authentication7 vulnerabilities

Jenkins Credentials Binding6 vulnerabilities

Jenkins Html Publisher6 vulnerabilities

Jenkins Delphix5 vulnerabilities

Jenkins Matrix Project5 vulnerabilities

Jenkins Wso2 Oauth5 vulnerabilities

Jenkins Git Parameter5 vulnerabilities

Jenkins Cadence Vmanager5 vulnerabilities

Jenkins Credentials4 vulnerabilities

Jenkins Appspider4 vulnerabilities

Jenkins Subversion Partial Release Manager4 vulnerabilities

Jenkins Github Branch Source4 vulnerabilities

Jenkins Health Advisor By Cloudbees4 vulnerabilities

Jenkins Katalon4 vulnerabilities

Jenkins Compuware Topaz For Total Test4 vulnerabilities

Jenkins Icescrum4 vulnerabilities

Recent Jenkins Security Advisories

Advisory Title Published
2026-02-18 Jenkins Security Advisory 2026-02-18 February 18, 2026
2025-12-10 Jenkins Security Advisory 2025-12-10 December 10, 2025
2025-10-29 Jenkins Security Advisory 2025-10-29 October 29, 2025
2025-09-17 Jenkins Security Advisory 2025-09-17 September 17, 2025
2025-09-03 Jenkins Security Advisory 2025-09-03 September 3, 2025
2025-07-09 Jenkins Security Advisory 2025-07-09 July 9, 2025
2025-06-06 Jenkins Security Advisory 2025-06-06 June 6, 2025
2025-05-14 Jenkins Security Advisory 2025-05-14 May 14, 2025
2025-04-10 Jenkins Security Advisory 2025-04-10 April 10, 2025
2025-04-02 Jenkins Security Advisory 2025-04-02 April 2, 2025

Known Exploited Jenkins Vulnerabilities

The following Jenkins vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title Description Added
Jenkins Remote Code Execution Vulnerability Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
CVE-2017-1000353 Exploit Probability: 94.5% 		October 2, 2025
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
CVE-2024-23897 Exploit Probability: 94.5% 		August 19, 2024
Jenkins User Interface (UI) Information Disclosure Vulnerability Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
CVE-2015-5317 Exploit Probability: 27.4% 		May 12, 2023
Jenkins Script Security Plugin Sandbox Bypass Vulnerability Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
CVE-2019-1003029 Exploit Probability: 92.6% 		April 25, 2022
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
CVE-2019-1003030 Exploit Probability: 93.1% 		March 25, 2022
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability A code execution vulnerability exists in the Stapler web framework used by Jenkins
CVE-2018-1000861 Exploit Probability: 94.5% 		February 10, 2022

Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. The vulnerability CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability is in the top 5% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 2 vulnerabilities in Jenkins with an average score of 6.2 out of ten. Last year, in 2025 Jenkins had 90 security vulnerabilities published. Right now, Jenkins is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.64.




Year Vulnerabilities Average Score
2026 2 6.15
2025 90 5.51
2024 32 6.18
2023 255 6.36
2022 389 6.16
2021 102 6.51
2020 228 6.00
2019 345 6.88
2018 120 6.45

It may take a day or so for new Jenkins vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Jenkins Security Vulnerabilities

CVE Date Vulnerability Products
CVE-2026-27100 Feb 18, 2026
Info Disclosure via Unchecked Run Parameter in Jenkins 2.550 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Jenkins
CVE-2026-27099 Feb 18, 2026
Jenkins 2.483-2.550 Stored XSS via Offline Cause Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
Jenkins
CVE-2025-67643 Dec 10, 2025
Jenkins Redpen - Pipeline to Jira: Path Validation Flaw <1.054, File Read Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
Jenkins
CVE-2025-67642 Dec 10, 2025
Jenkins Vault Plugin CVE-2025-67642: Context Miss for Vault Cred Leak Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.
Jenkins
CVE-2025-67641 Dec 10, 2025
Jenkins Coverage Plugin XSS via REST API ID unvalidated (before 2.3054) Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins
CVE-2025-67640 Dec 10, 2025
cmd injection via unescaped workspace path in Jenkins Git Client Plugin pre-6.4 Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
Jenkins
CVE-2025-67639 Dec 10, 2025
Jenkins CSRF in 2.540 & LTS 2.528.2 (CVE202567639) A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
Jenkins
CVE-2025-67638 Dec 10, 2025
Jenkins 2.540+ Build Auth Token Leak via Job Config Form Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Jenkins
CVE-2025-67637 Dec 10, 2025
Jenkins <=2.540: build auth tokens plaintext in config.xml (Item/Ext Read) Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Jenkins
CVE-2025-67636 Dec 10, 2025
Jenkins <2.540: View/Read Users Leaking Encrypted Passwords A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
Jenkins
CVE-2025-67635 Dec 10, 2025
Jenkins CLI HTTP DDOS CVE-2025-67635 Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Jenkins
CVE-2025-64150 Oct 29, 2025
Jenkins Publish-to-Bitbucket Plugin <0.4 RCE via Missing Permission Check A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins
CVE-2025-64149 Oct 29, 2025
CSRF in Jenkins Publish_to_Bitbucket Plugin 0.4 Captures Credentials A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins
CVE-2025-64148 Oct 29, 2025
Jenkins Publish to Bitbucket Plugin 0.4 enum creds IDs via absent perm check A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Jenkins
CVE-2025-64147 Oct 29, 2025
Jenkins Curseforge Publisher Plugin 1.0 API Key Disclosure Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Jenkins
CVE-2025-64146 Oct 29, 2025
Jenkins Curseforge Publisher 1.0 exfiltrates unencrypted API Keys in config.xml Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Jenkins
CVE-2025-64145 Oct 29, 2025
Jenkins BBA Plugin 1.0 API Tokens Unmasked in Job Config Form Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Jenkins
CVE-2025-64144 Oct 29, 2025
Jenkins ByteGuard Build Actions Plugin 1.0 API token disclosure via config.xml Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Jenkins
CVE-2025-64143 Oct 29, 2025
Unencrypted Auth Tokens Stored in Jenkins OpenShift Pipeline Plugin 1.0.57 Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Jenkins
CVE-2025-64142 Oct 29, 2025
Privilege Escalation: Jenkins Nexus Task Runner Plugin <0.9.3 missing permission check A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Jenkins
CVE-2025-64140 Oct 29, 2025
Jenkins Azure CLI Plugin v0.9: Arbitrary Shell Cmd Exec Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
Jenkins
CVE-2025-64141 Oct 29, 2025
CSRF in Jenkins Nexus Task Runner Plugin <=0.9.2 Allows Remote URL Connect A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Jenkins
CVE-2025-64139 Oct 29, 2025
Missing Permission Check in Jenkins Start Windocks Containers Plugin <=1.4 A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Jenkins
CVE-2025-64138 Oct 29, 2025
Jenkins Start Windocks Containers Plugin CSRF before 1.4 A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
Jenkins
CVE-2025-64137 Oct 29, 2025
Jenkins Themis Plugin <=1.4.1 RCE via Missing Permission Check A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
Jenkins
CVE-2025-64136 Oct 29, 2025
Jenkins Themis Plugin 1.4.1 CSRF allows remote HTTP server connectivity A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.
Jenkins
CVE-2025-64134 Oct 29, 2025
Jenkins JDepend Plugin up to 1.3.1 XXE via outdated JDepend Maven Plugin Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
Jenkins
CVE-2025-64135 Oct 29, 2025
Jenkins Eggplant Runner Plug <=0.0.1.301 jdk.http.auth.tunneling.disabledSchemes Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.
Jenkins
CVE-2025-64133 Oct 29, 2025
CSRF in Jenkins Extensible Choice Parameter Plugin Enables Groovy Execution A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.
Jenkins
CVE-2025-64132 Oct 29, 2025
Jenkins MCP Server Plugin 0.84 Improper Permission Checks Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.
Jenkins
CVE-2025-64131 Oct 29, 2025
Jenkins SAML Plugin <4.583 Replay Attack via Missing Replay Cache Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.
Jenkins
CVE-2025-59476 Sep 17, 2025
Jenkins 2.527/LTS 2.516.2: Log Injection via Unrestricted Char in Log Msg Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Jenkins
CVE-2025-59475 Sep 17, 2025
Jenkins 2.527 & LTS 2.516.2 Authenticated-User Profile Dropdown Bypass Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
Jenkins
CVE-2025-59474 Sep 17, 2025
Jenkins <=2.527 LTS: Sidepanel Exec Widget Auth Bypass (CVE-2025-59474) Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
Jenkins
CVE-2025-58460 Sep 03, 2025
Jenkins OpenTelemetry Plugin: Missing Permission Check (3.1543) Credential Exposure A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins
CVE-2025-58459 Sep 03, 2025
Jenkins global-build-stats Plugin REST API bypass allows ID enumeration Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
Jenkins
CVE-2025-58458 Sep 03, 2025
Jenkins Git Client Plugin 6.3.2 LFI via amazons3 URL Validation (Read) In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Jenkins
CVE-2025-53666 Jul 09, 2025
Jenkins Dead Man's Snitch 0.1: Unencrypted tokens stored (Item/Ext Read) Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Dead Mans Snitch
Jenkins
CVE-2025-53672 Jul 09, 2025
Unencrypted API Key Leak in Jenkins Kryptowire Plugin <0.3 Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Jenkins
CVE-2025-53667 Jul 09, 2025
Jenkins Dead Man's Snitch Plugin 0.1 Token Exposure Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Dead Mans Snitch
Jenkins
CVE-2025-53668 Jul 09, 2025
Jenkins VAddy Plugin 1.2.8-: Unencrypted API Keys Stored in Config XML Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Vaddy
Jenkins
CVE-2025-53669 Jul 09, 2025
Jenkins VAddy Plugin <=1.2.8: Auth Keys Exposed in UI (Info Disclosure) Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Vaddy
Jenkins
CVE-2025-53670 Jul 09, 2025
Jenkins Nouvola DiveCloud Plug 1.08 – API Keys Stored Unencrypted Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Nouvola Divecloud
Jenkins
CVE-2025-53653 Jul 09, 2025
Jenkins Aqua Scanner Plug <3.2.8: Unencrypted Token Storage Leaks Data Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Aqua Security Scanner
Jenkins
CVE-2025-53659 Jul 09, 2025
QMetry Plugin <=1.13 Exposes API Keys via config.xml (CVE-2025-53659) Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Qmetry Test Management
Jenkins
CVE-2025-53663 Jul 09, 2025
IBM Cloud DevOps Plugin 2.0.16 stores SonarQube tokens unencrypted in config.xml Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Ibm Cloud Devops
Jenkins
CVE-2025-53662 Jul 09, 2025
Jenkins IFTTT Build Notifier Plugin <=1.2 Unencrypted IFTTT Keys in config.xml Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Ifttt Build Notifier
Jenkins
CVE-2025-53661 Jul 09, 2025
Jenkins Testsigma TPRun Plugin <1.6 Exposes API Keys Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Testsigma Test Plan Run
Jenkins
CVE-2025-53660 Jul 09, 2025
Jenkins QMetry Plugin 1.13-: API Keys Unmasked in Job Config Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Qmetry Test Management
Jenkins
CVE-2025-53657 Jul 09, 2025
Jenkins ReadyAPI Plugin 1.11 – Unmasked SLM Keys Leak Sensitive Data (fixed 1.12) Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Readyapi Functional Testing
Jenkins
Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.