https://seclists.org/oss-sec/2026/q3/438: Multiple vulnerabilities in Jenkins and Jenkins plugins
Published Aug 5, 2026
·Updated
Affected Software
19 affected components
Jenkins Jenkins>=0<=2.575, >=0<=2.568.1
Jenkins Jenkins LTS<=2.568.1
npm/jenkins-remoting>=3384.v60d89463d9e0<=Earlier than 3384.v60d89463d9e0
jenkins/plugins/multijob<=669.v9d96a_d9c71b_0, <=669.v9d96a_d9c71b_0
jenkins/plugins/hcl-appscan<=1.8.3
jenkins/plugins/scm-manager<=1.11.1
jenkins/plugins/external-workspace-manager<=1.4.1
jenkins/plugins/webhook-secret-credentials-provider<=16.v0cfa_f0215cf5
jenkins/plugins/parameterized-remote-trigger<=3.2.2
jenkins/plugins/xml-job-to-job-dsl<=0.1.13
jenkins/plugins/qualys-container-scanning-connector<=1.8.0.5
jenkins/plugins/summary-display<=1.15
jenkins/plugins/google-chat-notification<=166.ve6b_de280f2e8
jenkins/plugins/horreum<=0.16.162.v33b_4a_a_b_5f828
jenkins/plugins/violation-comments-to-gitlab<=2.62.0
jenkins/plugins/sauce-on-demand<=2.2.0
jenkins/plugins/codesonar<=3.6.0
jenkins/plugins/aws-codebuild<=0.59
jenkins/plugins/ivy-report<=1.2
Frequently Asked Questions
1
What vulnerabilities are addressed in CVE-2026-XXXXX?
CVE-2026-XXXXX addresses multiple security vulnerabilities in Jenkins and various Jenkins plugins.
2
How do I fix CVE-2026-XXXXX?
To fix CVE-2026-XXXXX, update Jenkins to version 2.576 or LTS version 2.568.2 and ensure all affected plugins are also updated.
3
What plugins are affected by CVE-2026-XXXXX?
The affected plugins in CVE-2026-XXXXX include External Workspace Manager Plugin, HCL AppScan Plugin, Multijob Plugin, Scm Manager Plugin, and Webhook Secret Credentials Provider Plugin.
4
What is the severity of CVE-2026-XXXXX?
The severity of CVE-2026-XXXXX varies depending on the specific vulnerabilities, but they are considered significant enough to warrant immediate attention.
5
When were the fixes for CVE-2026-XXXXX released?
The fixes for CVE-2026-XXXXX were released on August 5, 2026.