Jenkins Multiple Plugin Vulnerability Advisory (Sandbox Bypass/RCE/CSRF)

Jenkins Security Advisory 2026-06-24 Vulnerability Summary Vulnerability Overview This advisory lists security vulnerabilities in multiple Jenkins plugins, including sandbox bypass, command injection, CSRF vulnerabilities, and missing permission checks. Scope of Impact Script Security Plugin: Contains a sandbox bypass vulnerability, allowing attackers to execute arbitrary code. Git Client Plugin: Contains a command injection vulnerability, allowing attackers to execute arbitrary commands. Pipeline: Groovy Plugin: Contains a CSRF vulnerability and an unrestricted type instantiation vulnerability. GitHub Branch Source Plugin: Contains a missing permission check vulnerability, allowing enumeration of GitHub Enterprise Server URLs. Git Parameter Plugin: Contains a missing permission check vulnerability, allowing listing of SCM branch and tag names. Job Configuration History Plugin: Contains a vulnerability where encrypted values are not overwritten, allowing viewing of encrypted keys. Active Directory Plugin: Contains an LDAP injection vulnerability, allowing enumeration of directory users and group names. MCP Server Plugin: Contains a missing permission check vulnerability, allowing reading of Pipeline replay scripts. Bitbucket Push and Pull Request Plugin: Contains a vulnerability where SSL/TLS certificate verification is unconditionally disabled. Priority Sorter Plugin: Contains a CSRF vulnerability. Gitee Plugin: Contains missing permission check and CSRF vulnerabilities. EC2 Fleet Plugin: Contains missing permission check and CSRF vulnerabilities. External Workspace Manager Plugin: Contains a path traversal vulnerability. Remediation Script Security Plugin: Upgrade to version 1402.v94c9ce464861 or later. Git Client Plugin: Upgrade to version 6.6.1 or later. Pipeline: Groovy Plugin: Upgrade to version 4331.v056fd4658ff or later. GitHub Branch Source Plugin: Upgrade to version 1967.1969.v205fd594c821 or later. Git Parameter Plugin: Upgrade to version 462.463.v496a_59f698e5 or later. Job Configuration History Plugin: Upgrade to version 1356.ve360da_6c523a_ or later. Active Directory Plugin: Upgrade to version 2.41.2 or later. MCP Server Plugin: Upgrade to version 0.178.vfe5a_e770f3b_ or later. Bitbucket Push and Pull Request Plugin: Upgrade to version 3.3.8 or later. Priority Sorter Plugin: Upgrade to version 936.937.v5581d0b_2ccb_a_ or later. Gitee Plugin: Upgrade to version 1288.v18b_deb_c9069b_ or later. EC2 Fleet Plugin: Upgrade to version 4.2.3.540.va_6eedb_7b_c112 or later. External Workspace Manager Plugin: Upgrade to version 1.3.2 or later. POC Code or Exploit Code No specific POC code or exploit code is included in the page. Summary This advisory details security vulnerabilities in multiple Jenkins plugins, along with their scope of impact and remediation steps. Users are advised to upgrade the relevant plugins as soon as possible to fix these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Multiple Plugin Vulnerability Advisory (Sandbox Bypass/RCE/CSRF)