https://seclists.org/oss-sec/2026/q2/712: Multiple vulnerabilities in Jenkins plugins
Published May 27, 2026
·Updated
Affected Software
11 affected components
Jenkins Active Directory Plugin<=2.41
Jenkins AppSpider Plugin<=1.0.17
Jenkins Bitbucket OAuth Plugin<=0.17
Jenkins Credentials Binding Plugin<=720.v3f6decef43ea_
Jenkins Email Extension Plugin<=1933.v45cec755423f
Jenkins GitHub Integration Plugin<=0.7.3
Jenkins Job Import Plugin<=143.v044a_2e819b_27
Jenkins LDAP Plugin<=807.v7d7de30930cf
Jenkins Multijob Plugin<=662.vd2e0001f6b_b_d
Jenkins Pipeline: Groovy Libraries Plugin<=797.v90ea_a_9b_e45a_0
Jenkins buildgraph-view Plugin<=1.8
Frequently Asked Questions
1
What is the severity of the vulnerabilities in Jenkins plugins identified in the bulletin?
The vulnerabilities in the Jenkins plugins are considered high severity due to potential impacts on security and functionality.
2
How do I fix the vulnerabilities in the Jenkins plugins mentioned in the bulletin?
To fix the vulnerabilities, update the affected plugins to their latest versions as specified in the security bulletin.
3
What versions of the Jenkins plugins have been released as fixes for the vulnerabilities?
The fixed versions for the vulnerabilities include Active Directory Plugin 2.41.1, AppSpider Plugin 1.0.18, and Bitbucket OAuth Plugin 0.18, among others.
4
Are the vulnerabilities in all Jenkins plugins critical?
Not all vulnerabilities in Jenkins plugins are critical, but they may still pose significant security risks if left unaddressed.
5
Is there a risk of exploitation for the Jenkins plugins vulnerabilities?
Yes, there is a risk of exploitation for these Jenkins plugin vulnerabilities, which could potentially lead to unauthorized access or code execution.