Jenkins vulnerabilities
We track 221 vulnerabilities in Jenkins products across 60+ products. 220 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on October 28, 2026.
Latest Jenkins vulnerabilities
- 8.8 High severity
Jenkins SAML Single Sign On(SSO) Plugin: Incorrect Permission Assignment for Critical Resource
Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins control
- 8.8 High severity
Jenkins SAML Single Sign On(SSO) Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller
- 8.8 High severity
Jenkins Azure VM Agents Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
- 8.8 High severity
Jenkins Reverse Proxy Auth Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
- 8.8 High severity
Jenkins File Parameter Plugin: Incorrect Permission Assignment for Critical Resource
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins contro
- 8.8 High severity
Jenkins Pipeline Utility Steps Plugin: Out-of-bounds Write
An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
- 8.8 High severity
Jenkins Report Portal Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified bearer token authentication.
- 7.5 High severity
Jenkins Thycotic DevOps Secrets Vault Plugin: Cleartext Transmission of Sensitive Information
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
- 7.5 High severity
Jenkins Azure Key Vault Plugin: Cleartext Transmission of Sensitive Information
Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
- 7.5 High severity
Jenkins Kubernetes Plugin: Cleartext Transmission of Sensitive Information
Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
- 9.8 Critical severity
Jenkins Convert To Pipeline Plugin: Improper Neutralization of Special Elements used in a Command
Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle
- 8.8 High severity
Jenkins Convert To Pipeline Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).
- 8.8 High severity
Jenkins OctoPerf Load Testing Plugin Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
- 9.6 Critical severity
Jenkins update-center2: Improper Neutralization of Input During Web Page Generation
Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
- 7.5 High severity
Jenkins: Allocation of Resources Without Limits or Throttling
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigg
- 7.5 High severity
Jenkins: Allocation of Resources Without Limits or Throttling
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to t
- 7.0 High severity
Jenkins: Incorrect Authorization
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jenk
- 9.6 Critical severity
Jenkins: Improper Neutralization of Input During Web Page Generation
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a
- 8.8 High severity
Jenkins Azure Credentials Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
- 9.9 Critical severity
Jenkins Email Extension Plugin: Protection Mechanism Failure
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in th
- 8.8 High severity
Jenkins BearyChat Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
- 8.8 High severity
Jenkins TestQuality Updater Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
- 8.8 High severity
Jenkins RabbitMQ Consumer Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
- 8.8 High severity
Jenkins OpenID Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
- 8.8 High severity
Jenkins JIRA Pipeline Steps Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi
- 8.8 High severity
Jenkins GitHub Pull Request Builder Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cred
- 8.8 High severity
Jenkins Orka by MacStadium Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credent
- 9.8 Critical severity
Jenkins Semantic Versioning Plugin: Improper Restriction of XML External Entity Reference
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins p
- 8.8 High severity
Jenkins Script Security Plugin: Improper Neutralization of Special Elements used in an OS Command
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute
- 7.5 High severity
Jenkins NS-ND Integration Performance…: Improper Certificate Validation
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.
- 7.5 High severity
Jenkins Config Rotator Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.
- 7.5 High severity
Jenkins CloudBees Docker Hub/Registry…: Missing Authorization
A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
- 8.1 High severity
Jenkins Pipeline Utility Steps Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to c
- 7.5 High severity
Jenkins Script Security Plugin: Inadequate Encryption Strength
Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.
- 7.5 High severity
Jenkins NS-ND Integration Performance…: Improper Certificate Validation
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.
- 7.5 High severity
Jenkins Compuware Topaz for Total Test Plugin: Improper Access Control
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file syste
- 8.8 High severity
Jenkins Katalon Plugin: Improper Control of Generation of Code
Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with configurable arguments, allowing attackers able to control agent processes to invoke Katalon on the J
- 8.8 High severity
Jenkins Pipeline: Input Step Plugin: Cross-Site Request Forgery
Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is no
- 8.8 High severity
Jenkins CONS3RT Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials store
- 8.8 High severity
Jenkins SCM HttpClient Plugin: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials