Known vulnerabilities in Jenkins
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-84646 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other… | 4.3 Medium | Sep 2, 2026 |
| CVE-2026-84647 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier,… | 8.8 High | Sep 2, 2026 |
| CVE-2026-84645 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in… | 8.8 High | Sep 2, 2026 |
| CVE-2026-19429 | Jenkins FilePath.untarFrom() does not validate symlink targets when extracting TAR archives, allowing an attacker with… | 8.8 High | Aug 10, 2026 |
| CVE-2026-70429 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names… | 8.1 High | Aug 5, 2026 |
| CVE-2026-70430 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as… | 2.7 Low | Aug 5, 2026 |
| CVE-2026-70428 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file… | 4.3 Medium | Aug 5, 2026 |
| CVE-2026-70426 | In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS… | 9.0 Critical | Aug 5, 2026 |
| CVE-2026-70427 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names… | 4.3 Medium | Aug 5, 2026 |
| CVE-2026-53442 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before… | 5.3 Medium | Jun 10, 2026 |
| CVE-2026-53441 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the… | 5.4 Medium | Jun 10, 2026 |
| CVE-2026-53439 | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read… | 4.3 Medium | Jun 10, 2026 |
| CVE-2026-53440 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet… | 4.3 Medium | Jun 10, 2026 |
| CVE-2026-53438 | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel… | 4.3 Medium | Jun 10, 2026 |
| CVE-2026-53437 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately… | 4.3 Medium | Jun 10, 2026 |
| CVE-2026-53435 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize… | 8.8 High | Jun 10, 2026 |
| CVE-2026-53436 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately… | 4.3 Medium | Jun 10, 2026 |
| CVE-2026-33002 | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin… | 7.5 High | Mar 18, 2026 |
| CVE-2026-33001 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar… | 8.8 High | Mar 18, 2026 |
| CVE-2026-27100 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting… | 4.3 Medium | Feb 18, 2026 |
| CVE-2026-27099 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the… | 8.0 High | Feb 18, 2026 |
| CVE-2025-67639 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers… | 3.5 Low | Dec 10, 2025 |
| CVE-2025-67638 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job… | 4.3 Medium | Dec 10, 2025 |
| CVE-2025-67637 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files… | 4.3 Medium | Dec 10, 2025 |
| CVE-2025-67636 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read… | 4.3 Medium | Dec 10, 2025 |
Other Jenkins project products
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins OpenId Connect Authentication Plugin 8
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins GitLab Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins OpenShift Deployer Plugin 7
Jenkins Amazon EC2 Plugin 7