CVE-2026-9674: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6bbd and earlier allows attackers to resume failed Multijob builds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Jenkins Multijob Pluginfrom your environment.Uninstall the Jenkins Multijob Plugin (versions 662.vd2e0001f6b_b_d and earlier) if it is not required.
- Compensating control
Restrict access to the Jenkins UI and build endpoints to trusted IPs, enforce strong authentication and RBAC for build/resume actions, and place Jenkins behind a WAF or firewall to reduce exposure until the plugin is updated or removed.
- Operational
Audit Multijob build history and Jenkins logs for any unauthorized resumed builds, investigate suspicious activity, and remediate any compromised accounts or sessions found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9674?
CVE-2026-9674 has a medium severity rating of 4.3 according to the CVSS v3.1.
How do I fix CVE-2026-9674?
To fix CVE-2026-9674, update the Jenkins Multijob Plugin to version 662.vd2e0001f6b_b_d or later.
What type of vulnerability is CVE-2026-9674?
CVE-2026-9674 is classified as a cross-site request forgery (CSRF) vulnerability.
What impact does CVE-2026-9674 have on Jenkins?
CVE-2026-9674 allows attackers to resume failed Multijob builds without proper authorization.
Which versions of Jenkins are affected by CVE-2026-9674?
CVE-2026-9674 affects Jenkins Multijob Plugin version 662.vd2e0001f6b_b_d and earlier.