Jenkins vulnerabilities
We track 221 vulnerabilities in Jenkins products across 60+ products. 220 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on October 28, 2026.
Latest Jenkins vulnerabilities
- 9.8 Critical severity
Jenkins Script Security Plugin: Protection Mechanism Failure
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection an
- 8.8 High severity
Jenkins docker-build-step Plugin: Missing Authorization
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided conne
- 8.8 High severity
Jenkins iceScrum Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
- 8.0 High severity
Jenkins GitBucket Plugin: Improper Neutralization of Input During Web Page Generation
Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
- 7.5 High severity
Jenkins Log Command Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary file
- 8.8 High severity
Jenkins: Origin Validation Error
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing att
- 9.8 Critical severity
Jenkins Command Line Interface (CLI) Path Traversal Exploited
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files o
- 8.8 High severity
Jenkins PaaSLane Estimate Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified token.
- 8.1 High severity
Jenkins HTMLResource Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.
- 8.8 High severity
Jenkins Nexus Platform Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing creden
- 8.8 High severity
Jenkins Nexus Platform Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
- 8.8 High severity
Jenkins NeuVector Vulnerability Scanner Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
- 8.8 High severity
Jenkins MATLAB Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.
- 9.8 Critical severity
Jenkins MATLAB Plugin: Missing Authorization
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
- 8.1 High severity
Jenkins CloudBees CD Plugin: Improper Link Resolution Before File Access
Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitr
- 7.5 High severity
jetty.project: Integer Overflow or Wraparound
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit
- 8.8 High severity
Jenkins Build Failure Analyzer Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
- 8.1 High severity
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using…
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers
- 8.1 High severity
Jenkins: Unrestricted Upload of File with Dangerous Type
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attacker
- 8.8 High severity
Jenkins: Incorrect Default Permissions
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system tem
- 8.8 High severity
Jenkins Assembla Auth Plugin: Missing Authorization
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and shoul
- 8.8 High severity
Jenkins SSH2 Easy Plugin: Improper Preservation of Permissions
Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled
- 7.5 High severity
Jenkins Bitbucket Push and Pull Request Plugin: Server-Side Request Forgery
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbuck
- 7.5 High severity
Jenkins Google Login Plugin: Incorrect Comparison
Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token.
- 7.5 High severity
Jenkins Azure AD Plugin: Incorrect Comparison
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statisti
- 8.8 High severity
Jenkins Job Configuration History Plugin: Improper Restriction of XML External Entity Reference
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- 8.8 High severity
Jenkins Blue Ocean Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.
- 7.5 High severity
Jenkins plug-in for ServiceNow DevOps: Missing Authorization
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version o
- 7.1 High severity
Jenkins ElasticBox CI Plugin: Missing Authorization
A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials s
- 8.8 High severity
Jenkins ElasticBox CI Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored
- 8.8 High severity
Jenkins Benchmark Evaluator Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controlle
- 8.8 High severity
Jenkins Assembla Auth Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attacker's account.
- 8.8 High severity
Jenkins Sumologic Publisher Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified URL.
- 8.8 High severity
Jenkins Pipeline restFul API Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token.
- 7.1 High severity
Jenkins Orka by MacStadium Plugin: Missing Authorization
A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentia
- 8.0 High severity
Jenkins: Cross-Site Request Forgery
In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexp
- 7.5 High severity
Jenkins HashiCorp Vault Plugin: Insertion of Sensitive Information into Log File
Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
- 7.5 High severity
Jenkins NS-ND Integration Performance…: Insufficiently Protected Credentials
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
- 8.8 High severity
Jenkins AppSpider Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
- 8.8 High severity
Jenkins SAML Single Sign On(SSO) Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.