By vendor

Jenkins vulnerabilities

Known CVEs affecting Jenkins products, prioritized by severity, with SEC.co remediation and detection guidance.

31 published vulnerabilities

• CVE-2026-53435HIGH 8.8

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a critical flaw in how they process configuration files. An authenticated attacker can craft a malicious `config.xml` file that causes Jenkins to deserialize and instantiate arbitrary Java objects from Jenkins core or installed plugins. Once deserialized, these objects can intercept and handle HTTP requests, enabling the attacker to impersonate any Jenkins user—including administrators—and perform actions such as accessing the Script Console to execute arbitrary code or reading sensitive files from the Jenkins controller.

• CVE-2026-57280HIGH 8.8

  Jenkins Script Security Plugin versions up to 1402.v94c9ce464861 contain a sandbox bypass vulnerability that allows authenticated attackers to execute arbitrary code. The flaw stems from incomplete type-cast handling in Groovy for-each loops, which permits attackers to invoke constructors that should be restricted by the sandbox. An attacker with script-execution privileges can exploit this to escape the plugin's security controls and run arbitrary Java constructors on the Jenkins server.

• CVE-2026-57301HIGH 8.8

  Jenkins users with the OWASP ZAP Plugin version 1.0.7 or earlier should be aware of a code execution vulnerability. The plugin is designed to run security scans on distributed Jenkins agents, but a flaw causes it to execute on the Jenkins controller itself instead. An attacker who has permission to configure Jenkins jobs can exploit this to run arbitrary code directly on your Jenkins controller—the central system that orchestrates all builds. This is particularly dangerous because the controller typically has broad access to credentials, source code, and other sensitive infrastructure.

• CVE-2026-57281HIGH 7.5

  Jenkins Script Security Plugin versions up to 1402.v94c9ce464861 contain a sandbox escape vulnerability. The plugin is designed to safely execute Groovy scripts within a restricted environment, but it fails to properly validate certain Groovy language features called AST transformation annotations. An attacker who can submit sandboxed Groovy scripts to a Jenkins instance can craft malicious code that uses these annotations to break out of the sandbox and execute arbitrary commands with the privileges of the Jenkins process. This requires the attacker to already have legitimate script execution permissions and relies on specific script libraries being available, but the impact—full code execution outside sandbox controls—is severe.

• CVE-2026-57303HIGH 7.1

  The Jenkins Assembla Plugin up to version 1.4 contains a weakness in how it parses XML responses from Assembla servers. An attacker who can intercept or control responses from the Assembla service could inject malicious XML that tricks the Jenkins controller into reading sensitive files from the system or making unauthorized network requests on behalf of Jenkins. This requires the attacker to have some control over network traffic to the Assembla server or the ability to compromise the Assembla service itself.

• CVE-2026-53441MEDIUM 5.4

  Jenkins versions 2.483–2.567 and LTS 2.492.1–2.555.2 contain a stored cross-site scripting (XSS) vulnerability in how they handle user-supplied descriptions for generic offline causes. An attacker with Agent/Configure permissions can inject malicious script into the offline cause description via the POST config.xml API, and that script will execute in the browsers of other users who view the Jenkins interface. This is a classic stored XSS—the payload persists in Jenkins' configuration until removed.

• CVE-2026-57294MEDIUM 5.4

  Jenkins users should be aware of a credential-exposure vulnerability in the EC2 Fleet Plugin. An attacker with read-only access to Jenkins can exploit a missing permission check to connect to arbitrary URLs and supply pre-obtained AWS credential IDs, potentially allowing them to retrieve sensitive AWS credentials stored within Jenkins. This affects Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and earlier.

• CVE-2026-57295MEDIUM 5.4

  Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows authenticated attackers to manipulate Jenkins into connecting to attacker-controlled URLs using AWS credential IDs they've obtained through other means. This can result in the exposure of AWS credentials stored within Jenkins, compromising cloud infrastructure access.

• CVE-2026-57304MEDIUM 5.4

  A flaw in Jenkins Assembla Plugin version 1.4 and earlier fails to verify that users should be allowed to configure external connections. An attacker with basic read access to Jenkins can exploit this to create or modify connections to any URL using credentials they control, potentially facilitating reconnaissance, credential theft, or lateral movement into connected systems.

• CVE-2026-57305MEDIUM 5.4

  Jenkins Assembla Plugin versions 1.4 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker with valid Jenkins access to trick an authenticated administrator into executing unintended actions. Specifically, an attacker can force the plugin to connect to an attacker-controlled URL using attacker-supplied credentials, potentially enabling data exfiltration, unauthorized integrations, or further compromise of connected systems.

• CVE-2026-53442MEDIUM 5.3

  Jenkins fails to encrypt sensitive credentials when they are submitted via POST requests to update job configurations. Instead of storing these secrets securely, Jenkins saves them in plain text within job config.xml files on the controller. Any user with permission to read job details or anyone with file system access to the Jenkins controller can view these unencrypted secrets, creating a path for credential theft.

• CVE-2026-57282MEDIUM 5.0

  Jenkins Git client Plugin versions 6.6.0 and earlier contain a command injection flaw in how they construct SSH wrapper scripts. When a Jenkins build runs in a workspace with a specially crafted directory name, an attacker with the ability to influence that workspace path can inject arbitrary shell commands that execute on the Jenkins agent. This requires authenticated access to create or influence build job workspace naming, limiting immediate risk but creating a significant privilege-escalation vector in multi-tenant Jenkins environments.

• CVE-2026-57289MEDIUM 4.8

  Jenkins Bitbucket Push and Pull Request Plugin version 3.3.8 and earlier contains a security flaw that disables SSL/TLS certificate validation when sending authentication tokens to Bitbucket Server. This means an attacker positioned to intercept network traffic—such as on a shared network or compromised router—could potentially capture the authentication token in transit, even though the connection appears secure. The vulnerability requires specific network conditions to exploit but represents a meaningful risk to Jenkins installations that rely on this plugin for Bitbucket integration.

• CVE-2026-53436MEDIUM 4.3

  Jenkins contains a validation flaw in its login redirect mechanism that allows attackers to craft phishing URLs appearing to come from a legitimate Jenkins instance. When users log in, Jenkins is supposed to redirect them to internal pages, but the vulnerability allows attackers to redirect users to external malicious sites by exploiting how the application handles relative path segments (like `./` or `../`). An attacker would need to trick a user into clicking a specially crafted link, but the exploit itself is straightforward and doesn't require special technical skills.

• CVE-2026-53437MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in how they validate redirect URLs after user login. An attacker can craft a malicious redirect URL that appears to point to a legitimate Jenkins instance by inserting tab or newline characters between the `//` protocol separator, causing the validation to pass. When a user clicks such a link after logging in, they may be redirected to an attacker-controlled site while believing they're staying within Jenkins, enabling credential harvesting or other phishing attacks.

• CVE-2026-53438MEDIUM 4.3

  Jenkins versions 2.567 and earlier (or LTS 2.555.2 and earlier) contain a permission bypass flaw that allows authenticated users holding the Item/Cancel permission to cancel build queue items without requiring Item/Read permission. This means an attacker with limited cancellation rights can disrupt builds they shouldn't be able to view or access, effectively using one permission to circumvent another. The vulnerability is not actively exploited in the wild and requires authenticated access, making it a moderate risk in most deployments.

• CVE-2026-53439MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a permission bypass vulnerability that allows low-privileged attackers to discover sensitive information about other users. Specifically, attackers who have been granted the basic Overall/Read permission can view other users' timezone settings and enumerate the names of views in other users' private "My Views" sections. This is an information disclosure issue that could support reconnaissance or social engineering attacks, though it does not enable direct system compromise.

• CVE-2026-53440MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in their "Delegate to servlet container" security realm that fails to validate redirect destinations after user login. An attacker can craft a malicious link that redirects authenticated users to an attacker-controlled website, enabling phishing attacks that steal credentials or distribute malware while appearing to come from a legitimate Jenkins instance.

• CVE-2026-57283MEDIUM 4.3

  A CSRF vulnerability in Jenkins Pipeline: Groovy Plugin allows authenticated attackers to manipulate job or system configuration through the Pipeline Snippet Generator without requiring user interaction. An attacker with valid Jenkins credentials can craft malicious requests that, when processed by a targeted Jenkins administrator or user, result in unintended configuration changes. This is a cross-site request forgery issue, meaning the attack leverages the trust relationship between a user and Jenkins to perform unauthorized actions.

• CVE-2026-57284MEDIUM 4.3

  Jenkins Pipeline: Groovy Plugin versions 4331.v9d06ed4658ff and earlier contain a vulnerability in the Pipeline Snippet Generator that allows authenticated attackers to instantiate arbitrary types beyond the intended Pipeline step components. This could enable attackers to instantiate types related to job or system configuration, potentially leading to unauthorized modification of pipeline definitions or system settings. The vulnerability requires authentication and does not involve user interaction, making it a concern for organizations where Jenkins access is broadly distributed among developers.

• CVE-2026-57285MEDIUM 4.3

  Jenkins GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier contain a security gap that allows any user with basic read permissions to discover the URLs of GitHub Enterprise servers connected to the Jenkins instance. This is an information disclosure issue—attackers cannot modify systems or take actions, but they can learn infrastructure details that may inform further attacks. The vulnerability requires authentication and is not currently exploited in the wild.

• CVE-2026-57286MEDIUM 4.3

  The Jenkins Git Parameter Plugin has a permission enforcement gap that lets users with basic read access to jobs extract sensitive information about the repositories those jobs use. Specifically, attackers can discover branch names, tag names, and revision metadata without needing higher-level permissions. While exploitation requires already having some level of access to Jenkins, this still represents a meaningful information disclosure risk in environments where job visibility is meant to be restricted.

• CVE-2026-57287MEDIUM 4.3

  The Jenkins Job Configuration History Plugin fails to hide encrypted secrets when showing past versions of job and agent configurations. An attacker with Extended Read permissions can view these encrypted secret values in the configuration history, bypassing the normal redaction that would hide them elsewhere in the interface. This is a credentials exposure issue that affects Jenkins administrators and users who rely on the plugin to maintain secure configuration records.

• CVE-2026-57290MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw in the Jenkins Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier allows attackers to trick administrators into unknowingly changing the plugin's job priority settings. An attacker can craft a malicious link or webpage that, when visited by a logged-in Jenkins administrator, silently modifies how jobs are prioritized in the queue—potentially disrupting workflow fairness or enabling job manipulation for malicious purposes.

• CVE-2026-57297MEDIUM 4.3

  A permission flaw in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier allows low-privileged users who have been granted basic read access to Jenkins to make unauthorized connections to external systems on behalf of the plugin. By exploiting this gap, attackers can specify which URL to connect to along with credentials (username, API key, and service key) to use—potentially allowing lateral movement, credential harvesting, or interaction with attacker-controlled infrastructure while appearing to originate from the Jenkins instance.

• CVE-2026-57299MEDIUM 4.3

  The Jenkins Contrast Continuous Application Security Plugin versions 3.11 and earlier contain a permission-check vulnerability that allows users with basic read access to discover the names of Contrast security configurations stored in Jenkins. While an attacker cannot modify or delete these configurations with this flaw alone, the ability to enumerate configuration names could support reconnaissance for follow-up attacks or reveal sensitive architectural details about an organization's security scanning setup.

• CVE-2026-57300MEDIUM 4.3

  Jenkins MCP Server Plugin versions 0.177.v629fdb_2557fe and earlier contain a missing permission check that allows attackers with basic Item/Read access to read Pipeline replay scripts from jobs they can browse. While the attacker cannot modify or disrupt those scripts, they can view their contents—potentially exposing sensitive logic, credentials, or other secrets embedded in replay configurations. This is a controlled-access vulnerability: the attacker must already have some permission within Jenkins to exploit it.

• CVE-2026-57302MEDIUM 4.3

  Jenkins FitNesse Plugin versions 1.36 and earlier fail to encrypt passwords before storing them in job configuration files on the Jenkins controller. This means any Jenkins user granted Extended Read permission—or anyone with direct file system access to the controller—can read these plaintext credentials. The vulnerability is localized to the Jenkins instance itself and does not enable remote code execution or wider system compromise, but it does create an unauthorized information disclosure risk for sensitive authentication data.

• CVE-2026-57306MEDIUM 4.2

  A CSRF vulnerability in the Jenkins Zowe zDevOps Plugin allows an attacker with login access to Jenkins to trick an authenticated user into performing actions that connect to attacker-controlled systems. By exploiting this flaw, an attacker can force Jenkins to use stored credentials to establish connections to malicious endpoints, potentially exposing those credentials to capture. The vulnerability requires an attacker to already know or obtain valid credential IDs from Jenkins, limiting the immediate exposure scope but creating a clear escalation path for authenticated threats.

• CVE-2026-57307MEDIUM 4.2

  Jenkins Zowe zDevOps Plugin versions 1.1.3.50.ve350c9b_450b_1 and earlier contain a permission check vulnerability that allows users with basic read access to Jenkins to exploit credential handling flaws. An attacker with Overall/Read permission can leverage known credential IDs to connect to arbitrary URLs using those stored credentials, potentially exposing sensitive authentication material. This is a moderate-severity issue that requires authenticated access but poses a real insider threat risk in shared Jenkins environments.

• CVE-2026-57288LOW 3.7

  Jenkins Active Directory Plugin version 2.41.1 and earlier contains a flaw in how it processes usernames during Windows authentication. When a user logs in, the plugin builds a search query to find that user in Active Directory, but it doesn't properly sanitize the username first. This allows an attacker to insert special LDAP characters into the username field to either discover what users exist in your directory or to log in as someone else if they know that person's password—even without knowing the exact username. The vulnerability requires attackers to have network access to Jenkins and knowledge of at least one valid password, making it a limited but real risk.