Jenkins vulnerabilities
We track 221 vulnerabilities in Jenkins products across 60+ products. 220 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on October 28, 2026.
Latest Jenkins vulnerabilities
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass
- 8.8 High severity
Jenkins: Improper Control of Generation of Code
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account in
- 8.1 High severity
Jenkins: Session Fixation
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins
- 8.1 High severity
Jenkins: Concurrent Execution using Shared Resource with Improper Synchronization
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administra
- 8.1 High severity
Jenkins: Improper Link Resolution Before File Access
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or em
- 8.8 High severity
Jenkins: Improper Limitation of a Pathname to a Restricted Directory
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configurat
- 8.8 High severity
Jenkins: Missing Authorization
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.
- 8.8 High severity
Jenkins Robot Framework Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to creat
- 8.0 High severity
Jenkins OWASP Dependency-Check Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- 8.0 High severity
Jenkins Coverage Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resu
- 8.0 High severity
Jenkins Warnings Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier,
- 7.5 High severity
Jenkins Script Security Plugin: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to byp
- 7.5 High severity
Jenkins Script Security Plugin: Download of Code Without Integrity Check
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries t
- 8.0 High severity
Jenkins Script Security Plugin: Improper Control of Generation of Code
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, al
- 8.5 High severity
Jenkins Script Security Plugin: Use of Externally-Controlled Input to Select Classes or Code
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute
- 8.8 High severity
Jenkins Script Security Plugin: Improper Control of Generation of Code
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation a
- 8.8 High severity
Jenkins Script Security Plugin: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attac
- 8.8 High severity
Jenkins Script Security Plugin: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scri
- 8.8 High severity
Jenkins Script Security Plugin: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowin
- 7.4 High severity
Jenkins TICS Plugin: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.
- 8.8 High severity
Jenkins Customizable Header Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cro
- 8.8 High severity
Jenkins Microsoft Entra ID (previously Azure…: Authorization Bypass Through User-Controlled Key
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name t
- 8.8 High severity
Jenkins File Parameter Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.
- 8.8 High severity
Jenkins Performance Plugin: Deserialization of Untrusted Data
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure per
- 8.8 High severity
Jenkins Allure Plugin: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.
- 8.8 High severity
Jenkins SAML Plugin: Improper Access Control
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
- 7.1 High severity
Jenkins ThinBackup Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins contr
- 8.0 High severity
Jenkins SonarQube Scanner Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable
- 7.3 High severity
Jenkins: Session Fixation
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the vict
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending o
- 8.8 High severity
Jenkins: Cross-Site Request Forgery
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generat
- 8.8 High severity
Jenkins: Improper Neutralization of Input During Web Page Generation
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processe
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with
- 8.8 High severity
Jenkins: Improper Control of Generation of Code
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitte
- 7.1 High severity
Jenkins Ivy Report Plugin: Improper Restriction of XML External Entity Reference
Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.
- 8.8 High severity
Jenkins Multijob Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
- 8.8 High severity
Jenkins Multijob Plugin: Improper Control of Generation of Code
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenki
- 9.0 Critical severity
Jenkins: Deserialization of Untrusted Data
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implemen
- 7.1 High severity
Jenkins Assembla Plugin: Server-Side Request Forgery
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform