Jenkins (Jenkins Project) - vulnerabilities (CVEs)

152 CVEs, 15 in the last 30 days, 3 known versions, newest CVE from 2026-10-28. Vendor: Jenkins Project.

CVEs of Jenkins

CVE-2026-117626, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and…
CVE-2026-117624, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their…
CVE-2026-117625, 2026-10-28: A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port,…
CVE-2026-117623, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a…
CVE-2026-117621, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory,…
CVE-2026-117622, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller,…
CVE-2026-117620, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can…
CVE-2026-117619, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a…
CVE-2026-117618, 2026-10-28: In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been…
CVE-2026-117617, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not…
CVE-2026-117616, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with…
CVE-2026-117614, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent…
CVE-2026-117615, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with…
CVE-2026-117613, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST…
CVE-2026-117612, 2026-10-28: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during…
CVE-2026-84654 - CVSS 5.4 (medium), 2026-09-02: In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding…
CVE-2026-84657 - CVSS 4.2 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a…
CVE-2026-84656 - CVSS 4.3 (medium), 2026-09-02: A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build…
CVE-2026-84655 - CVSS 4.3 (medium), 2026-09-02: Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing…
CVE-2026-84651 - CVSS 6.3 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted…
CVE-2026-84647 - CVSS 8.8 (high), 2026-09-02: In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not…
CVE-2026-84650 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit…
CVE-2026-84653 - CVSS 3.5 (low), 2026-09-02: Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance…
CVE-2026-84646 - CVSS 4.3 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers…
CVE-2026-84649 - CVSS 8.8 (high), 2026-09-02: In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both…
CVE-2026-84652 - CVSS 7.3 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing…
CVE-2026-84645 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in…
CVE-2026-84648 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a…
CVE-2026-70430 - CVSS 2.7 (low), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy…
CVE-2026-70429 - CVSS 8.1 (high), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create…
CVE-2026-70428 - CVSS 4.3 (medium), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with…
CVE-2026-70427 - CVSS 4.3 (medium), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and…
CVE-2026-70426 - CVSS 9 (critical), 2026-08-05: In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class…
CVE-2026-53441 - CVSS 5.4 (medium), 2026-06-10: Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline…
CVE-2026-53442 - CVSS 5.3 (medium), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations…
CVE-2026-53438 - CVSS 4.3 (medium), 2026-06-10: A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read…
CVE-2026-53437 - CVSS 7.4 (high), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains…
CVE-2026-53440 - CVSS 4.3 (medium), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to…
CVE-2026-53436 - CVSS 4.3 (medium), 2026-06-10: Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains…
CVE-2026-53439 - CVSS 4.3 (medium), 2026-06-10: Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users'…
CVE-2026-53435 - CVSS 8.8 (high), 2026-06-10: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or…
CVE-2026-33002 - CVSS 7.5 (high), 2026-03-18: Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI…
CVE-2026-33001 - CVSS 8.8 (high), 2026-03-18: Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted…
CVE-2026-27099 - CVSS 8 (high), 2026-02-18: Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark…
CVE-2026-27100 - CVSS 4.3 (medium), 2026-02-18: Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to,…
CVE-2025-67637 - CVSS 4.3 (medium), 2025-12-10: Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they…
CVE-2025-67636 - CVSS 4.3 (medium), 2025-12-10: A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values…
CVE-2025-67639 - CVSS 3.5 (low), 2025-12-10: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the…
CVE-2025-67638 - CVSS 4.3 (medium), 2025-12-10: Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential…
CVE-2025-67635 - CVSS 7.5 (high), 2025-12-10: Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing…
CVE-2025-59476 - CVSS 5.3 (medium), 2025-09-17: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log…
CVE-2025-59475 - CVSS 4.3 (medium), 2025-09-17: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers…
CVE-2025-59474 - CVSS 5.3 (medium), 2025-09-17: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking…
CVE-2025-31721 - CVSS 4.3 (medium), 2025-04-02: A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without…
CVE-2025-31720 - CVSS 4.3 (medium), 2025-04-02: A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without…
CVE-2025-27623 - CVSS 4.3 (medium), 2025-03-05: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI,…
CVE-2025-27625 - CVSS 4.3 (medium), 2025-03-05: In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform…
CVE-2025-27624 - CVSS 5.4 (medium), 2025-03-05: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their…
CVE-2025-27622 - CVSS 4.3 (medium), 2025-03-05: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI,…
CVE-2024-47803 - CVSS 4.3 (medium), 2024-10-02: Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the…
CVE-2024-47804 - CVSS 4.3 (medium), 2024-10-02: If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the…
CVE-2024-43045 - CVSS 6.3 (medium), 2024-08-07: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to…
CVE-2024-43044 - CVSS 8.8 (high), 2024-08-07: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the…
CVE-2024-23898 - CVSS 8.8 (high), 2024-01-24: Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI…
CVE-2024-23897 - CVSS 9.8 (critical), 2024-01-24: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path…
CVE-2023-43494 - CVSS 4.3 (medium), 2023-09-20: Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter…
CVE-2023-43497 - CVSS 8.1 (high), 2023-09-20: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system…
CVE-2023-43496 - CVSS 8.8 (high), 2023-09-20: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created…
CVE-2023-43495 - CVSS 5.4 (medium), 2023-09-20: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a…
CVE-2023-43498 - CVSS 8.1 (high), 2023-09-20: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system…
CVE-2023-39151 - CVSS 5.4 (medium), 2023-07-26: Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting…
CVE-2023-35141 - CVSS 8 (high), 2023-06-14: In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes…
CVE-2023-27900 - CVSS 7.5 (high), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts…
CVE-2023-27903 - CVSS 4.4 (medium), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created…
CVE-2023-27899 - CVSS 7 (high), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created…
CVE-2023-27902 - CVSS 4.3 (medium), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace…
CVE-2023-27898 - CVSS 9.6 (critical), 2023-03-10: Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when…
CVE-2023-27901 - CVSS 7.5 (high), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts…
CVE-2023-27904 - CVSS 5.3 (medium), 2023-03-10: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing…
CVE-2022-41224 - CVSS 5.4 (medium), 2022-09-21: Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting…
CVE-2022-34170 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is…
CVE-2022-34173 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting…
CVE-2022-34172 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site…
CVE-2022-34175 - CVSS 7.5 (high), 2022-06-23: Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments…
CVE-2022-34171 - CVSS 5.4 (medium), 2022-06-23: In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons…
CVE-2022-34174 - CVSS 7.5 (high), 2022-06-23: In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an…
CVE-2022-0538 - CVSS 7.5 (high), 2022-02-09: Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability…
CVE-2022-20612 - CVSS 4.3 (medium), 2022-01-12: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without…
CVE-2021-21687 - CVSS 9.1 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in…
CVE-2021-21690 - CVSS 9.8 (critical), 2021-11-04: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS…
CVE-2021-21693 - CVSS 9.8 (critical), 2021-11-04: When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS…
CVE-2021-21696 - CVSS 9.8 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the…
CVE-2021-21686 - CVSS 8.1 (high), 2021-11-04: File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing…
CVE-2021-21689 - CVSS 9.1 (critical), 2021-11-04: FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21692 - CVSS 9.8 (critical), 2021-11-04: FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission…
CVE-2021-21695 - CVSS 8.8 (high), 2021-11-04: FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2…
CVE-2021-21688 - CVSS 7.5 (high), 2021-11-04: The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations,…
CVE-2021-21691 - CVSS 9.8 (critical), 2021-11-04: Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21694 - CVSS 9.8 (critical), 2021-11-04: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and…
CVE-2021-21697 - CVSS 9.1 (critical), 2021-11-04: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few…