Jenkins (Jenkins) - vulnerabilities (CVEs)

282 CVEs, 0 in the last 30 days, 2341 known versions, newest CVE from 2026-09-02. Vendor: Jenkins.

CVEs of Jenkins

CVE-2026-84656 - CVSS 4.3 (medium), 2026-09-02: A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build…
CVE-2026-84655 - CVSS 4.3 (medium), 2026-09-02: Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing…
CVE-2026-84657 - CVSS 4.2 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a…
CVE-2026-84648 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a…
CVE-2026-84652 - CVSS 7.3 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing…
CVE-2026-84646 - CVSS 4.3 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers…
CVE-2026-84651 - CVSS 6.3 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted…
CVE-2026-84645 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in…
CVE-2026-84653 - CVSS 3.5 (low), 2026-09-02: Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance…
CVE-2026-84650 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit…
CVE-2026-70430 - CVSS 2.7 (low), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy…
CVE-2026-70429 - CVSS 8.1 (high), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create…
CVE-2026-70428 - CVSS 4.3 (medium), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with…
CVE-2026-70427 - CVSS 4.3 (medium), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and…
CVE-2026-53442 - CVSS 5.3 (medium), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations…
CVE-2026-53441 - CVSS 5.4 (medium), 2026-06-10: Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline…
CVE-2026-53437 - CVSS 7.4 (high), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains…
CVE-2026-53440 - CVSS 4.3 (medium), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to…
CVE-2026-53436 - CVSS 4.3 (medium), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains…
CVE-2026-53439 - CVSS 4.3 (medium), 2026-06-10: Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users'…
CVE-2026-53435 - CVSS 8.8 (high), 2026-06-10: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or…
CVE-2026-53438 - CVSS 4.3 (medium), 2026-06-10: A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read…
CVE-2026-33001 - CVSS 8.8 (high), 2026-03-18: Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted…
CVE-2026-33002 - CVSS 7.5 (high), 2026-03-18: Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI…
CVE-2026-27100 - CVSS 4.3 (medium), 2026-02-18: Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to,…
CVE-2026-27099 - CVSS 8 (high), 2026-02-18: Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark…
CVE-2025-67636 - CVSS 4.3 (medium), 2025-12-10: A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values…
CVE-2025-67639 - CVSS 3.5 (low), 2025-12-10: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the…
CVE-2025-67638 - CVSS 4.3 (medium), 2025-12-10: Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential…
CVE-2025-67637 - CVSS 4.3 (medium), 2025-12-10: Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they…
CVE-2025-67635 - CVSS 7.5 (high), 2025-12-10: Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing…
CVE-2025-59475 - CVSS 4.3 (medium), 2025-09-17: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers…
CVE-2025-59474 - CVSS 5.3 (medium), 2025-09-17: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking…
CVE-2025-59476 - CVSS 5.3 (medium), 2025-09-17: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log…
CVE-2024-9453 - CVSS 6.5 (medium), 2025-07-04: A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are…
CVE-2025-31721 - CVSS 4.3 (medium), 2025-04-02: A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without…
CVE-2025-31720 - CVSS 4.3 (medium), 2025-04-02: A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without…
CVE-2025-27623 - CVSS 4.3 (medium), 2025-03-05: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI,…
CVE-2025-27625 - CVSS 4.3 (medium), 2025-03-05: In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform…
CVE-2025-27624 - CVSS 5.4 (medium), 2025-03-05: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their…
CVE-2025-27622 - CVSS 4.3 (medium), 2025-03-05: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI,…
CVE-2024-47803 - CVSS 4.3 (medium), 2024-10-02: Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the…
CVE-2024-47804 - CVSS 4.3 (medium), 2024-10-02: If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the…
CVE-2024-43045 - CVSS 6.3 (medium), 2024-08-07: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to…
CVE-2024-43044 - CVSS 8.8 (high), 2024-08-07: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the…
CVE-2024-34148 - CVSS 6.8 (medium), 2024-05-02: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a…
CVE-2024-23898 - CVSS 8.8 (high), 2024-01-24: Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI…
CVE-2024-23897 - CVSS 9.8 (critical), 2024-01-24: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path…
CVE-2023-36478 - CVSS 7.5 (high), 2023-10-10: Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-43497 - CVSS 8.1 (high), 2023-09-20: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system…
CVE-2023-43496 - CVSS 8.8 (high), 2023-09-20: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created…
CVE-2023-43495 - CVSS 5.4 (medium), 2023-09-20: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a…
CVE-2023-43498 - CVSS 8.1 (high), 2023-09-20: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system…
CVE-2023-43494 - CVSS 4.3 (medium), 2023-09-20: Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter…
CVE-2023-39151 - CVSS 5.4 (medium), 2023-07-26: Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting…
CVE-2023-35141 - CVSS 8 (high), 2023-06-14: In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes…
CVE-2023-27900 - CVSS 7.5 (high), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts…
CVE-2023-27903 - CVSS 4.4 (medium), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created…
CVE-2023-27899 - CVSS 7 (high), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created…
CVE-2023-27902 - CVSS 4.3 (medium), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace…
CVE-2023-27898 - CVSS 9.6 (critical), 2023-03-10: Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when…
CVE-2023-27901 - CVSS 7.5 (high), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts…
CVE-2023-27904 - CVSS 5.3 (medium), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing…
CVE-2022-41224 - CVSS 5.4 (medium), 2022-09-21: Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting…
CVE-2022-2048 - CVSS 7.5 (high), 2022-07-07: In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly…
CVE-2022-34174 - CVSS 7.5 (high), 2022-06-23: In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an…
CVE-2022-34170 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is…
CVE-2022-34173 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting…
CVE-2022-34172 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site…
CVE-2022-34175 - CVSS 7.5 (high), 2022-06-23: Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments…
CVE-2022-34171 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons…
CVE-2022-0538 - CVSS 7.5 (high), 2022-02-09: Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability…
CVE-2021-43859 - CVSS 7.5 (high), 2022-02-01: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU…
CVE-2022-20612 - CVSS 4.3 (medium), 2022-01-12: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without…
CVE-2021-21689 - CVSS 9.1 (critical), 2021-11-04: FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21692 - CVSS 9.8 (critical), 2021-11-04: FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission…
CVE-2021-21695 - CVSS 8.8 (high), 2021-11-04: FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2…
CVE-2021-21688 - CVSS 7.5 (high), 2021-11-04: The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations,…
CVE-2021-21691 - CVSS 9.8 (critical), 2021-11-04: Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21694 - CVSS 9.8 (critical), 2021-11-04: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and…
CVE-2021-21697 - CVSS 9.1 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few…
CVE-2021-21687 - CVSS 9.1 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in…
CVE-2021-21690 - CVSS 9.8 (critical), 2021-11-04: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS…
CVE-2021-21693 - CVSS 9.8 (critical), 2021-11-04: When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS…
CVE-2021-21696 - CVSS 9.8 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the…
CVE-2021-21686 - CVSS 8.1 (high), 2021-11-04: File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing…
CVE-2021-21685 - CVSS 9.1 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
CVE-2021-21683 - CVSS 6.5 (medium), 2021-10-06: The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal…
CVE-2021-21682 - CVSS 4.3 (medium), 2021-10-06: Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the…
CVE-2021-21671 - CVSS 7.5 (high), 2021-06-30: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.
CVE-2021-21670 - CVSS 4.3 (medium), 2021-06-30: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even…
CVE-2021-21640 - CVSS 4.3 (medium), 2021-04-07: Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create…
CVE-2021-21639 - CVSS 4.3 (medium), 2021-04-07: Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API…
CVE-2021-28165 - CVSS 7.5 (high), 2021-04-01: In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2021-21615 - CVSS 5.3 (medium), 2021-01-26: Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to…
CVE-2021-21611 - CVSS 5.4 (medium), 2021-01-13: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored…
CVE-2021-21610 - CVSS 6.1 (medium), 2021-01-13: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query…
CVE-2021-21608 - CVSS 5.4 (medium), 2021-01-13: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability…
CVE-2021-21604 - CVSS 8 (high), 2021-01-13: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old…