Jenkins vulnerabilities
We track 221 vulnerabilities in Jenkins products across 60+ products. 220 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on October 28, 2026.
Latest Jenkins vulnerabilities
- 8.8 High severity
Jenkins OWASP ZAP Plugin: Externally Controlled Reference to a Resource in Another Sphere
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
- 8.8 High severity
Jenkins External Workspace Manager Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenki
- 8.5 High severity
Jenkins Script Security Plugin: Improper Neutralization of CRLF Sequences
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script
- 8.8 High severity
Jenkins Script Security Plugin: Protection Mechanism Failure
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructo
- 7.4 High severity
Jenkins: URL Redirection to Untrusted Site
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requ
- 7.5 High severity
Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize…
Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, whi
- 7.5 High severity
Jenkins Pipeline: Groovy Libraries Plugin: Improper Link Resolution Before File Access
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controll
- 8.8 High severity
Jenkins Email Extension Plugin: External Control of File Name or Path
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email c
- 8.0 High severity
Jenkins HTML Publisher Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- 9.0 Critical severity
Jenkins GitHub Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable
- 7.5 High severity
Jenkins Credentials Binding Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can le
- 7.5 High severity
Jenkins: Reliance on Reverse DNS Resolution for a Security-Critical Action
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTT
- 8.8 High severity
Jenkins: Improper Link Resolution Before File Access
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system acces
- 8.0 High severity
Jenkins: Improper Neutralization of Input During Web Page Generation
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable
- 7.5 High severity
Jenkins: Improper Resource Shutdown or Release
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
- 8.8 High severity
Jenkins Azure CLI Plugin: Improper Neutralization of Special Elements used in an OS Command
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
- 7.1 High severity
Jenkins JDepend Plugin: Improper Restriction of XML External Entity Reference
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
- 7.5 High severity
Jenkins SAML Plugin: Authentication Bypass by Capture-replay
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkin
- 8.2 High severity
Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git…
Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters.
- 7.3 High severity
Jenkins Credentials Binding Plugin: Insufficiently Protected Credentials
Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.
- 8.0 High severity
Jenkins Gatling Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to chan
- 9.8 Critical severity
Jenkins WSO2 Oauth Plugin: Improper Authentication
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, i
- 8.8 High severity
Jenkins Health Advisor by CloudBees Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health A
- 9.1 Critical severity
Jenkins OpenID Connect Provider Plugin: Improper Access Control
In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a
- 9.1 Critical severity
Jenkins jenkins/ssh-slave Docker images: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves in
- 9.1 Critical severity
Jenkins jenkins/ssh-agent Docker images: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves
- 8.8 High severity
Jenkins Templating Engine Plugin: Improper Control of Generation of Code
In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
- 8.8 High severity
Jenkins OpenId Connect Authentication Plugin: Incorrect Default Permissions
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as
- 8.8 High severity
Jenkins Bitbucket Server Integration Plugin: Cross-Site Request Forgery
Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
- 8.0 High severity
Jenkins Simple Queue Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
- 8.8 High severity
Jenkins Shared Library Version Override Plugin: Missing Authorization
Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to confi
- 8.0 High severity
Jenkins Authorize Project Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- 8.0 High severity
Jenkins Pipeline: Declarative Plugin: Incorrect Default Permissions
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build
- 8.0 High severity
Jenkins Pipeline: Groovy Plugin: Improper Validation of Integrity Check Value
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whos
- 8.1 High severity
Jenkins OpenId Connect Authentication Plugin: Improper Authentication
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
- 8.1 High severity
Jenkins OpenId Connect Authentication Plugin: Improper Authentication
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
- 7.5 High severity
Jenkins Credentials Plugin: Insufficiently Protected Credentials
Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.
- 8.8 High severity
Jenkins: Improper Check for Unusual or Exceptional Conditions
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
- 8.8 High severity
Jenkins Script Security Plugin: Authentication Bypass by Spoofing
A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including