Jenkins Plugin Security Advisory: Multiple CVEs (RCE/CSRF/LDAP Injection)

Jenkins Security Advisory 2026-06-24 Vulnerability Overview 1. Script Security Plugin Sandbox Bypass Vulnerability - CVE: CVE-2026-57280 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin version 1402.v94c9ce464861 and earlier versions do not intercept implicit type conversions, allowing attackers to bypass sandbox protections and execute arbitrary code. - Remediation: Upgrade to version 1402.vc96e74964250 or later. 2. Script Security Plugin Script Security Bypass Vulnerability - CVE: CVE-2026-57281 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin version 1402.v94c9ce464861 and earlier versions do not reject certain Groovy AST transformation annotations, allowing attackers to execute scripts outside the sandbox. - Remediation: Upgrade to version 1402.vc96e74964250 or later. 3. Git Client Plugin OS Command Injection Vulnerability - CVE: CVE-2026-57282 - Severity: Medium - Affected Plugin: git-client - Description: Git client Plugin version 6.6.0 and earlier versions fail to correctly escape the working directory name, allowing attackers to inject shell commands. - Remediation: Upgrade to version 6.6.1 or later. 4. Pipeline: Groovy Plugin CSRF Vulnerability and Unrestricted Type Instantiation - CVE: CVE-2026-57283 (CSRF), CVE-2026-57284 (Unrestricted Type Instantiation) - Severity: Medium - Affected Plugin: workflow-cps - Description: Pipeline: Groovy Plugin version 4331.vd056d44658ff and earlier versions do not restrict instantiable types and contain a CSRF vulnerability. - Remediation: Upgrade to version 4331.4333.v50a_b_076e5199 or later. 5. GitHub Branch Source Plugin Missing Permission Check - CVE: CVE-2026-57285 - Severity: Medium - Affected Plugin: github-branch-source - Description: GitHub Branch Source Plugin version 1967.1969.v205fd594c821 and earlier versions do not perform permission checks, allowing attackers to enumerate GitHub Enterprise Server URLs. - Remediation: Upgrade to version 1967.1970.v8d86979736546 or later. 6. Git Parameter Plugin Missing Permission Check - CVE: CVE-2026-57286 - Severity: Medium - Affected Plugin: git-parameter - Description: Git Parameter Plugin version 462.vdcf3df2ed2ca_ and earlier versions do not perform permission checks, allowing attackers to list SCM branch and tag names. - Remediation: Upgrade to version 462.463.v496a_59f698e5 or later. 7. Job Configuration History Plugin Unredirected Encrypted Values - CVE: CVE-2026-57287 - Severity: Medium - Affected Plugin: jobConfigHistory - Description: Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier versions do not redirect encrypted values, allowing attackers to view encrypted keys. - Remediation: Upgrade to version 1367.vc8fa_b_15101dc or later. 8. Active Directory Plugin LDAP Injection Vulnerability - CVE: CVE-2026-57288 - Severity: Low - Affected Plugin: active-directory - Description: Active Directory Plugin version 2.41.1 and earlier versions do not escape usernames, allowing attackers to inject LDAP wildcard characters. - Remediation: Upgrade to version 2.41.2 or later. 9. MCP Server Plugin Missing Permission Check - CVE: CVE-2026-57300 - Severity: Medium - Affected Plugin: mcp-server - Description: MCP Server Plugin version 0.177.v629fdb_2557fe and earlier versions do not perform permission checks, allowing attackers to retrieve Pipeline scripts. - Remediation: Upgrade to version 0.178.vffe5a_e770f3b_ or later. 10. Bitbucket Push and Pull Request Plugin SSL/TLS Certificate Verification Disabled - CVE: CVE-2026-57289 - Severity: Medium - Affected Plugin: bitbucket-push-and-pull-request - Description: Bitbucket Push and Pull Request Plugin version 3.3.8 and earlier versions unconditionally disable SSL/TLS certificate verification, allowing attackers to intercept network traffic. - Remediation: Upgrade to version 3.3.9 or later. 11. Priority Sorter Plugin CSRF Vulnerability - CVE: CVE-2026-57290 - Severity: Medium - Affected Plugin: PrioritySorter - Description: Priority Sorter Plugin version 936.v2c01c6b_84449 and earlier versions do not require POST requests, allowing attackers to overwrite global job priority configurations. - Remediation: Upgrade to version 936.937.v5581d0b_2ccb_a_ or later. 12. Gitee Plugin Missing Permission Check and CSRF Vulnerability - CVE: CVE-2026-57291 (Missing Permission Check), CVE-2026-57292 (CSRF) - Severity: Medium - Affected Plugin: gitee - Description: Gitee Plugin version 1288.v18b_deb_c9069b_ and earlier versions do not perform permission checks and contain a CSRF vulnerability. - Remediation: Upgrade to version 1292.v2559f2f3f2c0 or later. 13. Gitee Plugin Credential ID Enumeration - CVE: CVE-2026-57293 - Severity: Medium - Affected Plugin: gitee - Description: Gitee Plugin version 1288.v18b_deb_c9069b_ and earlier versions fail to properly perform permission checks, allowing attackers to enumerate credential IDs. - Remediation: Upgrade to version 1292.v2559f2f3f2c0 or lat

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Advisory: Multiple CVEs (RCE/CSRF/LDAP Injection)