CVE-2026-92132: Jenkins Gradle Plugin vulnerability
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Gradle Pluginto a version that resolves this vulnerability.Fixed in 2.19.1252.v15196b_5a_6e10 - Compensating control
Ensure Jenkins cannot connect to attacker-controlled URLs that may appear in build logs (e.g., restrict outbound network connectivity so Jenkins only reaches the intended Develocity server).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to control the build log so they can place an attacker-specified build scan link in it. Jenkins then requests build scan data from that URL.
What sensitive information could be exposed?
The Develocity access key configured in Jenkins global configuration can be captured when Jenkins connects to the attacker-specified URL.
Are installations with a configured Develocity server URL protected?
No. A configured global Develocity server URL does not prevent affected versions from requesting build scan data from the build scan link detected in the build log.
Which versions are affected?
Jenkins Gradle Plugin version 2.19.1252.v15196b_5a_6e10 and earlier are affected.