In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 (both inclusive), except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
Jenkins 2.580 Jenkins LTS 2.568.3 Allure Plugin 2.36.0 Customizable Header Plugin 330.v8a8d87511ea1 File Parameter Plugin 433.va0b80359d54d GitLab Plugin 1.9.182144.vc1c369226a52 Job Configuration History Plugin 1380.v762185b9a793 LDAP Plugin 825.v2fca37dd5bcb Microsoft Entra ID (previously Azure AD) Plugin 711.v34046f788fd7 Performance Plugin 1017.v9e9f7bbbc5e7 Pipeline: Build Step Plugin 601.v6d4c6d1a9dc7 Pipeline: Groovy Libraries Plugin 805.vafc79344957d SAML Plugin 4.623.v7875d61cd9f5 Script Security Plugin 1415.v9af9b3ac253d SonarQube Scanner Plugin 2.19.0 ThinBackup Plugin 2.1.5 TICS Plugin 2026.1.0 XebiaLabs XL Deploy Plugin 26.3.0
Additionally, we announce unresolved security issues in the following plugins:
Parameterized Remote Trigger Plugin
Summaries of the vulnerabilities are below. More details, severity, and attribution can be found here: https://www.jenkins.io/security/advisory/2026-09-02/
We provide advance notification for security updates on this mailing list: https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as described here: https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3972 / CVE-2026-84645 Jenkins uses serialization and deserialization to load and save configuration and build data (using XStream). Types storing their configuration in their own files (usually config.xml or build.xml), like agents, items, or builds, are indicated as such by implementing the Java interface PersistenceRoot. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that only allows deserialization of types defined in Jenkins core or plugins, or explicitly allowed types (JEP-200).
Jenkins uses the Stapler web framework for HTTP request handling. Stapler's basic premise is that it uses reflective access to code elements matching its naming conventions. Since 2018, Jenkins limits request routing to only types defined in Jenkins core or plugins, and can only access fields and methods that have (return) types, parameters, or annotations related to HTTP request handling.
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, serialized objects of types marked as storing their configuration in independent top-level configuration files can appear as nested field values in user-submitted config.xml documents and subsequently handle HTTP requests via Stapler. A crafted combination of such objects can result in attackers getting access to an improperly protected Script Console, resulting in remote code execution.
SECURITY-3908 / CVE-2026-84646 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.
NOTE: These user objects are not actual Jenkins accounts and cannot be used to log in. They are similar to the objects Jenkins creates from SCM changelogs to associate commits with their authors.
SECURITY-3915 / CVE-2026-84647 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's form data binding instantiates configuration objects of types specified in form submissions.
In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form submissions to those compatible with the expected field type, allowing attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.
SECURITY-3967 / CVE-2026-84648 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
TIP: On Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability.
SECURITY-3878 / CVE-2026-84649 Jenkins uses the Stapler web framework for HTTP request handling. Stapler provides an HTTP endpoint serving dynamically generated JavaScript resources.
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 (both inclusive), except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), these dynamically generated JavaScript resources embed the user's cross-site request forgery (CSRF) token (crumb) as a string literal in their response.
These resources can be loaded as a script by a page hosted on the same site as Jenkins, such as a sibling subdomain
(e.g., other-service.example.org when Jenkins is at jenkins.example.org), allowing attackers to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
IMPORTANT: This vulnerability is particularly impactful when the Resource Root URL is configured on thesame site as the Jenkins URL (e.g., jenkins-assets.example.org and jenkins.example.org).
SECURITY-4032 / CVE-2026-84650 In Jenkins, fields declared transient are excluded from serialization but are still read back during deserialization for backward compatibility with existing configuration files.
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.
SECURITY-4025 / CVE-2026-84651 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document.
This allows attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration, obtaining access to its inbound agent secret and environment variables.
SECURITY-4016 / CVE-2026-84652 Jenkins's "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again.
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, resulting in a session fixation vulnerability.
This allows attackers able to serve content on the same site as Jenkins, such as a sibling subdomain (e.g., evil.example.org when Jenkins is at jenkins.example.org), to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
NOTE: This cannot be exploited from an unrelated domain (e.g., evil.example.com targeting Jenkins at jenkins.example.org).
SECURITY-3981 / CVE-2026-84653 Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page added in Jenkins 2.421.
This allows attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
NOTE: The impact of this vulnerability depends on installed plugins. For example, Simple Theme Plugin allows specifying URLs for JavaScript resources served on every Jenkins page, which can result in a cross-site scripting (XSS) vulnerability.
SECURITY-3926 / CVE-2026-84654 Jenkins uses the Stapler web framework for HTTP request handling.
In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object.
This allows attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.
SECURITY-3879 / CVE-2026-84655 Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API.
This allows attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.
SECURITY-4006 / CVE-2026-84656 Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not perform an Item/Read permission check in an HTTP endpoint.
This allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.
SECURITY-4015 / CVE-2026-84657 The build command of the Jenkins CLI can be invoked with the -s flag to wait for a triggered build to complete, canceling the build when the CLI client is interrupted.
Jenkins merges multiple requests to build the same job with the same parameters into a single queue item.
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when canceling a build this way.
This allows attackers with Item/Build permission to cancel builds started by other users by triggering a build that merges with an existing queue item, then interrupting the CLI command.
SECURITY-3986 / CVE-2026-84658 (script approval) & CVE-2026-84659 (Groovy sandbox) Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.
Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
Additionally, it does not enforce a permission check in a @DataBoundSetter annotated method, allowing attackers to invoke it to disable the "Force the use of the sandbox globally in the system" setting.
SECURITY-3870 / CVE-2026-84660 (build step) & CVE-2026-84661 (waitForBuild step) Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks. Plugins like Authorize Project Plugin allow changing the authentication associated with a build.
Canceling a Pipeline using the build step causes the triggered downstream build to be canceled. The same applies to the waitForBuild step when the propagateAbort parameter is set to true.
Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier does not check Item/Cancel permission on the downstream job before canceling those builds in these cases.
This causes downstream builds to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
SECURITY-3678 / CVE-2026-84662 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments.
LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier uses the @DataBoundConstructor annotation on a constructor that connects to a specified URL.
This allows attackers able to submit certain forms to connect to an attacker-specified URL without the required permission.
SECURITY-3815 / CVE-2026-84663 Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to delete shared library caches.
SECURITY-4097 / CVE-2026-84664 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.
GitLab Plugin 1.9.16 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that overwrite the global GitLab connection configuration.
This allows attackers able to submit certain forms to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.
SECURITY-3989 / CVE-2026-84665 SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
TIP: On Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability.
SECURITY-4098 / CVE-2026-84666 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.
Job Configuration History Plugin 1367.vc8fab15101dc and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin's history recording configuration.
This allows attackers able to submit certain forms to redirect history storage to an attacker-specified directory and modify history recording settings.
SECURITY-4099 / CVE-2026-84667 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.
ThinBackup Plugin 2.1.4 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin's backup configuration.
This allows attackers able to submit certain forms to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.
SECURITY-4065 / CVE-2026-84668 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments.
SAML Plugin 4.618.v441a27fa46d2 and earlier uses the @DataBoundConstructor annotation on a constructor that writes the SAML identity provider metadata file to the Jenkins controller file system.
This allows attackers able to submit certain forms to overwrite the SAML identity provider metadata with attacker-controlled content without the required permission, allowing them to authenticate as any user.
SECURITY-3645 / CVE-2026-84669 Allure Plugin 2.35.2 and earlier does not correctly validate file paths when serving Allure report results.
This allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.
SECURITY-4026 / CVE-2026-84670 Performance Plugin uses Java serialization to cache performance reports in the build directory.
Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller.
This allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
SECURITY-4093 / CVE-2026-84671 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments.
File Parameter Plugin validates parameter names when creating build parameter definitions to ensure they are safe to use as file name components.
File Parameter Plugin 425.v3fa801681b5e and earlier uses the @DataBoundConstructor annotation on a constructor that stores uploaded files using the parameter name as a path without this validation.
This allows attackers able to submit certain forms to write files to arbitrary locations on the Jenkins controller file system, which can lead to remote code execution.
SECURITY-3935 / CVE-2026-84672 Microsoft Entra ID (previously Azure AD) Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID (GUID) and its display name. Entra group display names are not globally unique, and unless the tenant restricts it, any tenant member can create a group with an arbitrary display name.
This allows attackers who can create an Entra group with a display name matching that of a group with a privileged Jenkins permission grant to gain those permissions, even when the grant was configured using the group's object ID.
SECURITY-4104 / CVE-2026-84673 Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.
Customizable Header Plugin 295.v2544bca19b97 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin's appearance configuration.
This allows attackers able to submit certain forms to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.
SECURITY-3948 / CVE-2026-84674 XebiaLabs XL Deploy Plugin 26.1.0 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
SECURITY-3987 / CVE-2026-84675 TICS Plugin 2025.1.1 and earlier does not correctly escape build environment variable values when constructing the OS command it executes.
This allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.
SECURITY-3800 / CVE-2026-84676 Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
SECURITY-4038 / CVE-2026-84677 Update-center2 is the tool used to generate the Jenkins update sites hosted on updates.jenkins.io.
NOTE: While it is designed for use by the Jenkins project for this purpose, others may be using it to operate their own self-hosted update sites.
update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) when rendering plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
NOTE: As of publication of this advisory, the Jenkins security team is not aware of any plugin having been released with malicious content exploiting this vulnerability.
-- CONFIDENTIALITY NOTICE: This email and any attachments contain confidential and proprietary information of CloudBees intended only for the named recipient(s). Unauthorized use or distribution is prohibited. If you received this in error, please notify the sender and delete this email.
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in isissuerknown, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check while pointing the OIDC discovery and JWKS fetches at a server the attacker controls. An unauthenticated caller of POST /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen host, and to have oidc.verifytoken accept a JWT signed with the attacker's own key.
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.
As of publication of this advisory, there is no fix.
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
All, FYI:
DARPA and ARPA-H are running a research competition called the "AI Cyber Challenge" (AIxCC). Its goal is to create automated tools that find and fix vulnerabilities in software. General information is here: <https://aicyberchallenge.com/>
The AIxCC semifinal competition was last week at DEF CON 32 (2024). All competitors were given an identical set of Challenge Projects, which were real-world OSS projects seeded with synthetic vulnerabilities. The projects were Jenkins, Linux kernel, Nginx, SQLite3, and Apache Tika. There were 7 winners; each winner received $2 million US as a reward, and those teams will be allowed to compete in the finals at next year's DEF CON.
An official summary is here: <https://www.darpa.mil/news-events/2024-08-11>. Some other interesting links related to the semifinals include: <https://blog.trailofbits.com/2024/08/09/trail-of-bits-buttercup-heads-to-darpas-aixcc/> <https://www.youtube.com/watch?v=sQKGWZvuLko>
One of the competing teams, Team Atlanta, even found a real-world bug in SQLite3. This was reported to SQLite through their usual process; it's fixed in trunk. More info about that specifically is here: - <https://x.com/TeamAtlanta24/status/1822739301463130271> - <https://sqlite.org/forum/forumpost/81670d1056>
The tools must be released by next year as open source software, with an OSI-approved license, as a condition for accepting prize money or competing in the final competition. Exact text is in the "Open-Source Requirement" section in its rules <https://aicyberchallenge.com/rules/>. The challenge problems were all based on real-world OSS, and the hope is that in the long term such tools can automatically find & fix vulnerabilities in all software including OSS.
Full disclosure: I work for the Open Source Security Foundation (OpenSSF) and I have been working with DARPA & ARPA-H supporting this. That said, I thought others in this mailing list would want to know about it. No research is guaranteed to produce something leading to useful results, but I think this is a promising approach. We definitely could use tools that automatically find & fix vulnerabilities, if they're good enough!!
--- David A. Wheeler
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the ClassLoaderProxy#fetchJar method in the Remoting library.
Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.
A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified token.
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.
Jenkins MATLAB Plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory.
MATLAB Plugin 2.11.0 and earlier does not perform permission checks in several HTTP endpoints implementing related form validation.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to create files on the Jenkins controller file system to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
MATLAB Plugin 2.11.1 configures its XML parser to prevent XML external entity (XXE) attacks.
Additionally, POST requests and Item/Configure permission are required for the affected HTTP endpoints.
Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb327fca3db11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.
Jenkins Zanata Plugin 0.6 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token hashes are equal.
This could potentially allow attackers to use statistical methods to obtain a valid webhook token.
As of publication of this advisory, there is no fix.
Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Gogs Plugin 1.0.15 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal.
This could potentially allow attackers to use statistical methods to obtain a valid webhook token.
As of publication of this advisory, there is no fix.
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.
A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins.
Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1.
Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control TAP file contents.