Jenkins Security Bulletin: Multiple Plugin Vulnerabilities (RCE/Sandbox Bypass/CSRF)

Jenkins Security Advisory 2026-06-24 Vulnerability Summary Vulnerability Overview This advisory lists security vulnerabilities in multiple Jenkins plugins, including sandbox bypass, command injection, CSRF vulnerabilities, and missing permission checks. Scope of Impact Script Security Plugin: Contains a sandbox bypass vulnerability allowing attackers to execute arbitrary code. Git client Plugin: Contains an OS command injection vulnerability allowing attackers to execute arbitrary commands. Pipeline: Groovy Plugin: Contains CSRF vulnerabilities and unrestricted type instantiation. GitHub Branch Source Plugin: Missing permission checks allow enumeration of GitHub Enterprise Server URLs. Git Parameter Plugin: Missing permission checks allow listing SCM branch and tag names. Job Configuration History Plugin: Contains a vulnerability where encrypted values are not overwritten. Active Directory Plugin: Contains an LDAP injection vulnerability. MCP Server Plugin: Missing permission checks allow reading Pipeline replay scripts. Bitbucket Push and Pull Request Plugin: Contains a vulnerability where SSL/TLS certificate verification is unconditionally disabled. Priority Sorter Plugin: Contains CSRF vulnerabilities. Gitee Plugin: Missing permission checks and CSRF vulnerabilities. EC2 Fleet Plugin: Missing permission checks and CSRF vulnerabilities. External Workspace Manager Plugin: Contains a path traversal vulnerability. Remediation Script Security Plugin: Upgrade to version 1402.v94c9ce464861 or higher. Git client Plugin: Upgrade to version 6.6.1 or higher. Pipeline: Groovy Plugin: Upgrade to version 4331.vd06ed4658ff or higher. GitHub Branch Source Plugin: Upgrade to version 1967.1969.v205fd594c821 or higher. Git Parameter Plugin: Upgrade to version 462.463.v496a_59f698e5 or higher. Job Configuration History Plugin: Upgrade to version 1356.ve360da_6c523a_ or higher. Active Directory Plugin: Upgrade to version 2.41.2 or higher. MCP Server Plugin: Upgrade to version 0.177.v629fdb_2557fe or higher. Bitbucket Push and Pull Request Plugin: Upgrade to version 3.3.8 or higher. Priority Sorter Plugin: Upgrade to version 936.937.v5581d0b_2ccb_a_ or higher. Gitee Plugin: Upgrade to version 1288.v18b_deb_c9069b_ or higher. EC2 Fleet Plugin: Upgrade to version 4.2.3.539.v8fedff2a_81c3 or higher. External Workspace Manager Plugin: Upgrade to version 1.3.2 or higher. POC Code or Exploit Code No specific POC code or exploit code was provided on the page. --- Above is the key vulnerability summary for Jenkins Security Advisory 2026-06-24. It is recommended to update relevant plugins as soon as possible to patch these security vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Multiple Plugin Vulnerabilities (RCE/Sandbox Bypass/CSRF)