Jenkins Security Bulletin: Script Security RCE, Git Client Cmd Injection CVEs

Jenkins Security Advisory 2026-06-24 Vulnerability Summary Vulnerability Overview 1. Script Security Plugin Sandbox Bypass Vulnerability - CVE: CVE-2026-57280 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin version 1402.v94c9ce464861 and earlier versions do not intercept implicit type conversions, allowing attackers to bypass sandbox protections and execute arbitrary code. - Remediation: Upgrade to Script Security Plugin version 1402.1405.vc96e74964250 or later. 2. Script Security Plugin Script Security Bypass Vulnerability - CVE: CVE-2026-57281 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin version 1402.v94c9ce464861 and earlier versions do not reject Groovy AST transformation annotations, allowing attackers to execute scripts outside the sandbox. - Remediation: Upgrade to Script Security Plugin version 1402.1405.vc96e74964250 or later. 3. Git client Plugin OS Command Injection Vulnerability - CVE: CVE-2026-57282 - Severity: Medium - Affected Plugin: git-client - Description: Git client Plugin version 6.6.0 and earlier versions do not properly escape the working directory name, allowing attackers to inject shell commands. - Remediation: Upgrade to Git client Plugin version 6.6.1 or later. 4. Pipeline: Groovy Plugin CSRF Vulnerability and Unrestricted Type Instantiation - CVE: CVE-2026-57283 (CSRF), CVE-2026-57284 (unrestricted instantiation of types) - Severity: Medium - Affected Plugin: workflow-cps - Description: Pipeline: Groovy Plugin version 4331.v056fd4658ff and earlier versions do not restrict instantiable types, allowing attackers to create malicious scripts via a CSRF vulnerability. - Remediation: Upgrade to Pipeline: Groovy Plugin version 4331.4333.v50a_b_076c5199 or later. 5. GitHub Branch Source Plugin Missing Permission Check - CVE: CVE-2026-57285 - Severity: Medium - Affected Plugin: github-branch-source - Description: GitHub Branch Source Plugin version 1967.1969.v205fd594c821 and earlier versions do not perform permission checks, allowing attackers to enumerate GitHub Enterprise Server URLs. - Remediation: Upgrade to GitHub Branch Source Plugin version 1967.1970.v8d86979736546 or later. 6. Git Parameter Plugin Missing Permission Check - CVE: CVE-2026-57286 - Severity: Medium - Affected Plugin: git-parameter - Description: Git Parameter Plugin version 462.vdcf3df2ed2ca_ and earlier versions do not perform permission checks, allowing attackers to list SCM branch and tag names. - Remediation: Upgrade to Git Parameter Plugin version 462.463.v496a_59f698e5 or later. 7. Job Configuration History Plugin Encrypted Values Not Redirected - CVE: CVE-2026-57287 - Severity: Medium - Affected Plugin: jobConfigHistory - Description: Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier versions do not redirect encrypted values, allowing attackers to view encrypted keys. - Remediation: Upgrade to Job Configuration History Plugin version 1367.vc8fa_b_15101dc or later. 8. Active Directory Plugin LDAP Injection Vulnerability - CVE: CVE-2026-57288 - Severity: Low - Affected Plugin: active-directory - Description: Active Directory Plugin version 2.41.1 and earlier versions do not escape usernames, allowing attackers to inject LDAP wildcard characters. - Remediation: Upgrade to Active Directory Plugin version 2.41.2 or later. 9. MCP Server Plugin Missing Permission Check - CVE: CVE-2026-57300 - Severity: Medium - Affected Plugin: mcp-server - Description: MCP Server Plugin version 0.177.v629fdb_2557fe and earlier versions do not perform permission checks, allowing attackers to retrieve Pipeline scripts. - Remediation: Upgrade to MCP Server Plugin version 0.178.vffe5a_e770f3b_ or later. 10. Bitbucket Push and Pull Request Plugin SSL/TLS Certificate Verification Disabled - CVE: CVE-2026-57289 - Severity: Medium - Affected Plugin: bitbucket-push-and-pull-request - Description: Bitbucket Push and Pull Request Plugin version 3.3.8 and earlier versions unconditionally disable SSL/TLS certificate verification, allowing attackers to intercept network traffic. - Remediation: Upgrade to Bitbucket Push and Pull Request Plugin version 3.3.9 or later. 11. Priority Sorter Plugin CSRF Vulnerability - CVE: CVE-2026-57290 - Severity: Medium - Affected Plugin: PrioritySorter - Description: Priority Sorter Plugin version 936.v2c01c6b_84449 and earlier versions do not require POST requests, allowing attackers to overwrite global job priority configurations. - Remediation: Upgrade to Priority Sorter Plugin version 936.937.v5581d0b_2ccb_a_ or later. 12. Gitee Plugin Missing Permission Check and CSRF Vulnerability - CVE: CVE-2026-57291 (missing permission check), CVE-2026-57292 (CSRF) - Severity: Medium - Affected Plugin: gitee - Description: Gitee Plugin version 1288.v18b_deb_c9069b_ and earlier versions do not perform permission checks, allowing attackers to connect and capture credentials. - Remediation: Upgrade to Gitee Plugin

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Script Security RCE, Git Client Cmd Injection CVEs