Known vulnerabilities in Jenkins
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-117626 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… | 4.3 Medium | Oct 28, 2026 |
| CVE-2026-117624 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… | 8.8 High | Oct 28, 2026 |
| CVE-2026-117625 | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… | 4.3 Medium | Oct 28, 2026 |
| CVE-2026-117623 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… | 5.4 Medium | Oct 28, 2026 |
| CVE-2026-117622 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler… | 6.1 Medium | Oct 28, 2026 |
| CVE-2026-117621 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace… | 6.1 Medium | Oct 28, 2026 |
| CVE-2026-117619 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication,… | 8.1 High | Oct 28, 2026 |
| CVE-2026-117620 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings… | 8.8 High | Oct 28, 2026 |
| CVE-2026-117618 | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not… | 8.1 High | Oct 28, 2026 |
| CVE-2026-117616 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without… | 8.8 High | Oct 28, 2026 |
| CVE-2026-117617 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only… | 8.1 High | Oct 28, 2026 |
| CVE-2026-117614 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into… | 8.8 High | Oct 28, 2026 |
| CVE-2026-117615 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being… | 6.5 Medium | Oct 28, 2026 |
| CVE-2026-117612 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by… | 8.8 High | Oct 28, 2026 |
| CVE-2026-117613 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization,… | 5.4 Medium | Oct 28, 2026 |
| CVE-2026-84656 | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read… | 4.3 Medium | Sep 2, 2026 |
| CVE-2026-84657 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission… | 4.2 Medium | Sep 2, 2026 |
| CVE-2026-84655 | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and… | 4.3 Medium | Sep 2, 2026 |
| CVE-2026-84653 | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform… | 3.5 Low | Sep 2, 2026 |
| CVE-2026-84654 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier,… | 5.4 Medium | Sep 2, 2026 |
| CVE-2026-84651 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration… | 6.3 Medium | Sep 2, 2026 |
| CVE-2026-84652 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is… | 7.3 High | Sep 2, 2026 |
| CVE-2026-84650 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization,… | 8.8 High | Sep 2, 2026 |
| CVE-2026-84648 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata… | 8.8 High | Sep 2, 2026 |
| CVE-2026-84649 | In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included… | 8.8 High | Sep 2, 2026 |
Other Jenkins project products
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins OpenId Connect Authentication Plugin 8
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins GitLab Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins OpenShift Deployer Plugin 7
Jenkins Amazon EC2 Plugin 7