Jenkins Script Security Bypass, RCE & Plugin Vulnerabilities Advisory

Jenkins Security Advisory 2026-06-24 Vulnerability Summary 1. Sandbox bypass vulnerability in Script Security Plugin Vulnerability Overview: Script Security Plugin versions 1402.v94c9ce464861 and earlier do not intercept implicit type conversions, allowing attackers to bypass the sandbox and execute arbitrary code. Affected Scope: All Jenkins users running Script Security Plugin 1402.v94c9ce464861 or earlier. Remediation: Upgrade to Script Security Plugin 1402.1405.vc96e74964250 or later. 2. Script security bypass vulnerability in Script Security Plugin Vulnerability Overview: Script Security Plugin versions 1402.v94c9ce464861 and earlier do not reject certain Groovy AST transformation annotations, allowing attackers to execute scripts outside the sandbox. Affected Scope: All Jenkins users running Script Security Plugin 1402.v94c9ce464861 or earlier. Remediation: Upgrade to Script Security Plugin 1402.1405.vc96e74964250 or later. 3. OS command injection vulnerability on agents in Git client Plugin Vulnerability Overview: Git client Plugin versions 6.6.0 and earlier fail to properly escape workspace directory names, allowing attackers to inject shell commands. Affected Scope: All Jenkins users running Git client Plugin 6.6.0 or earlier. Remediation: Upgrade to Git client Plugin 6.6.1 or later. 4. CSRF vulnerability and unrestricted instantiation of types in Pipeline: Groovy Plugin Vulnerability Overview: Pipeline: Groovy Plugin versions 4331.vd056d44658ff and earlier do not restrict instantiable types, allowing attackers to create Cross-Site Request Forgery (CSRF) vulnerabilities. Affected Scope: All Jenkins users running Pipeline: Groovy Plugin 4331.vd056d44658ff or earlier. Remediation: Upgrade to Pipeline: Groovy Plugin 4331.4333.v50a_b_076e5199 or later. 5. Missing permission check allows enumerating GitHub Enterprise server URLs in GitHub Branch Source Plugin Vulnerability Overview: GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier do not perform permission checks, allowing attackers to enumerate GitHub Enterprise server URLs. Affected Scope: All Jenkins users running GitHub Branch Source Plugin 1967.1969.v205fd594c821 or earlier. Remediation: Upgrade to GitHub Branch Source Plugin 1967.1970.v868979736546 or later. 6. Missing permission check in Git Parameter Plugin allows listing SCM branch and tag names Vulnerability Overview: Git Parameter Plugin versions 462.vdcf3df2ed2ca_ and earlier do not perform permission checks, allowing attackers to list SCM branch and tag names. Affected Scope: All Jenkins users running Git Parameter Plugin 462.vdcf3df2ed2ca_ or earlier. Remediation: Upgrade to Git Parameter Plugin 462.463.v496a_59f698e5 or later. 7. Encrypted values of secrets in job and agent configurations not redacted by Job Configuration History Plugin Vulnerability Overview: Job Configuration History Plugin versions 1356.ve360da_6c523a_ and earlier do not redact encrypted secret values, allowing attackers to view sensitive information. Affected Scope: All Jenkins users running Job Configuration History Plugin 1356.ve360da_6c523a_ or earlier. Remediation: Upgrade to Job Configuration History Plugin 1367.vc8fa_b_15101dc or later. 8. LDAP injection vulnerability in Active Directory Plugin Vulnerability Overview: Active Directory Plugin versions 2.41.1 and earlier do not escape usernames, allowing attackers to inject LDAP wildcard characters. Affected Scope: All Jenkins users running Active Directory Plugin 2.41.1 or earlier. Remediation: Upgrade to Active Directory Plugin 2.41.2 or later. 9. Missing permission check in MCP Server Plugin allows reading Pipeline replay scripts Vulnerability Overview: MCP Server Plugin versions 0.177.v629fdb_2557fe and earlier do not perform permission checks, allowing attackers to read Pipeline scripts. Affected Scope: All Jenkins users running MCP Server Plugin 0.177.v629fdb_2557fe or earlier. Remediation: Upgrade to MCP Server Plugin 0.178.vffe5a_e770f3b_ or later. 10. SSL/TLS certificate validation unconditionally disabled by Bitbucket Push and Pull Request Plugin Vulnerability Overview: Bitbucket Push and Pull Request Plugin versions 3.3.8 and earlier unconditionally disable SSL/TLS certificate validation, allowing attackers to intercept network traffic. Affected Scope: All Jenkins users running Bitbucket Push and Pull Request Plugin 3.3.8 or earlier. Remediation: Upgrade to Bitbucket Push and Pull Request Plugin 3.3.9 or later. 11. CSRF vulnerability in Priority Sorter Plugin Vulnerability Overview: Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier do not require POST requests, allowing attackers to override global job priority configurations. Affected Scope: All Jenkins users running Priority Sorter Plugin 936.v2c01c6b_84449 or earlier. Remediation: Upgrade to Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ or later. 12. Missing permission checks and CSRF vulnerability in Gitee Plugin Vulnerability Overview: Gitee Plugin versions 12

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Script Security Bypass, RCE & Plugin Vulnerabilities Advisory