Jenkins Security Bulletin: Multiple Plugins Vulnerabilities (RCE, Sandbox Bypass, CSRF)

The following is a summary of key vulnerability information from the webpage screenshot: --- Jenkins Security Advisory 2026-06-24 Vulnerability Overview This advisory discloses multiple security vulnerabilities in Jenkins plugins, including sandbox escapes, command injection, CSRF, missing authorization checks, LDAP injection, and disabled SSL/TLS verification. Some vulnerabilities allow attackers to execute arbitrary code, steal credentials, or escalate privileges. --- Affected Scope The affected plugins and versions are as follows: Script Security Plugin ( ) - Version ≤ 1402.v94c9ce464861 - Vulnerability: Sandbox escape (unintercepted type casting), Groovy AST annotation bypass Git client Plugin ( ) - Version ≤ 6.6.0 - Vulnerability: OS command injection (working directory name not escaped) Pipeline: Groovy Plugin ( ) - Version ≤ 4331.vd056d4658ff - Vulnerability: CSRF + unrestricted type instantiation GitHub Branch Source Plugin ( ) - Version ≤ 1967.1969.v205fd594c821 - Vulnerability: Enumeration of GitHub Enterprise server URLs Git Parameter Plugin ( ) - Version ≤ 462.vdcf3df2ed2ca_ - Vulnerability: Listing of SCM branch and tag names Job Configuration History Plugin ( ) - Version ≤ 1356.ve360da_6c523a_ - Vulnerability: Encryption key displayed without sanitization Active Directory Plugin ( ) - Version ≤ 2.41.1 - Vulnerability: LDAP injection MCP Server Plugin ( ) - Version ≤ 0.177.v629fdb_2557fe - Vulnerability: Reading of Pipeline replay scripts Bitbucket Push and Pull Request Plugin ( ) - Version ≤ 3.3.8 - Vulnerability: Unconditional disabling of SSL/TLS certificate verification Priority Sorter Plugin ( ) - Version ≤ 936.v2c01c6b_84449 - Vulnerability: CSRF modification of global priority configuration Gitee Plugin ( ) - Version ≤ 1288.v18b_deb_c9069b_ - Vulnerability: Missing authorization check + CSRF - Version ≤ 1292.v2559f2f3fc2c0 - Vulnerability: Enumeration of credential IDs EC2 Fleet Plugin ( ) - Version ≤ 4.2.3.539.v8fedff2a_81c3 - Vulnerability: Missing authorization check + CSRF - Version ≤ 4.2.3.540.va_6eedb_7b_c112 - Vulnerability: Form validation bypass External Workspace Manager Plugin ( ) - Version ≤ 1.3.2 - Vulnerability: Path traversal --- Remediation Patched versions of each plugin have been released. It is recommended to upgrade to the following versions: Script Security Plugin → ≥ 1402.vc96e74964250 Git client Plugin → ≥ 6.6.1 Pipeline: Groovy Plugin → ≥ 4331.4333.v50a_b_076c5199 GitHub Branch Source Plugin → ≥ 1967.1970.v8d6979736546 Git Parameter Plugin → ≥ 462.463.v496a_59f698e5 Job Configuration History Plugin → ≥ 1367.vc8fa_b_15101dc Active Directory Plugin → ≥ 2.41.2 MCP Server Plugin → ≥ 0.178.vffe5a_e770f3b_ Bitbucket Push and Pull Request Plugin → ≥ 3.3.9 Priority Sorter Plugin → ≥ 936.937.v5581d0b_2ccb_a_ Gitee Plugin → ≥ 1292.v2559f2f3fc2c0 EC2 Fleet Plugin → ≥ 4.2.3.540.va_6eedb_7b_c112 External Workspace Manager Plugin → ≥ 1.3.3 (assumed subsequent version) --- POC / Exploit Code No directly executable POC code blocks are provided on the page, but exploitation methods are described: Example 1: Script Security Sandbox Escape (Type Casting) Example 2: Git client Command Injection Example 3: Pipeline Groovy CSRF + Type Instantiation Example 4: LDAP Injection Example 5: Bitbucket SSL/TLS Disabling > Note: The above represents exploit logic reconstructed from descriptions, not original POC code. Actual exploitation requires integration with the specific environment. --- ✅ It is recommended to immediately upgrade all affected plugins to the latest stable versions and review permission configurations and network policies.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Multiple Plugins Vulnerabilities (RCE, Sandbox Bypass, CSRF)