5.4
Medium
CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler…
Description
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins GitLab Plugin 1.9 | earliest → 1.9.16 | No fix stated |
References
- Jenkins Security Advisory 2026-09-02 www.jenkins.io
Timeline
- Published
- Last modified
Other CVEs of Jenkins GitLab Plugin
The 8 CVEs of Jenkins GitLab Plugin →
CVE-2026-92133
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API…
5.4
Medium
CVE-2025-24397
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure…
4.3
Medium
CVE-2022-43411
Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided…
5.3
Medium
CVE-2022-34777
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…
Not rated