https://seclists.org/oss-sec/2026/q3/639: Multiple vulnerabilities in Jenkins and Jenkins plugins

Q: Which components have fixes available?

Fixes are available in Jenkins 2.580 and Jenkins LTS 2.568.3, as well as the listed releases of Allure, Customizable Header, File Parameter, GitLab, Job Configuration History, LDAP, Microsoft Entra ID, Performance, Pipeline: Build Step, Pipeline: Groovy Libraries, SAML, Script Security, SonarQube Scanner, ThinBackup, TICS, and XebiaLabs XL Deploy plugins.

Q: Which plugin has unresolved security issues?

The Parameterized Remote Trigger Plugin has unresolved security issues. The provided information does not identify a fixed version for that plugin.

Q: How can I determine whether my Jenkins instance needs updates?

Compare the installed Jenkins core and plugin versions with the releases listed in the advisory. Instances running an earlier release than the listed fixed release should be reviewed for update.

Published Sep 2, 2026

Updated

Affected Software

2 affected components

Jenkins>2.0<=2.579, >=2.426.1<=2.568.2

Stapler>1839.ved17667b_a_eb_5<=2107.v8dfcb_e8ed317

Frequently Asked Questions

Which components have fixes available?

Fixes are available in Jenkins 2.580 and Jenkins LTS 2.568.3, as well as the listed releases of Allure, Customizable Header, File Parameter, GitLab, Job Configuration History, LDAP, Microsoft Entra ID, Performance, Pipeline: Build Step, Pipeline: Groovy Libraries, SAML, Script Security, SonarQube Scanner, ThinBackup, TICS, and XebiaLabs XL Deploy plugins.

Which plugin has unresolved security issues?

The Parameterized Remote Trigger Plugin has unresolved security issues. The provided information does not identify a fixed version for that plugin.

How can I determine whether my Jenkins instance needs updates?