Jenkins Plugin Vulnerabilities: RCE, Command Injection, CSRF (CVE-2026-57280 to 57287)

Jenkins Security Advisory 2026-06-24 Vulnerability Overview 1. Script Security Plugin Sandbox Escape - CVE: CVE-2026-57280 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin versions 1402.v94c9ce464861 and earlier failed to intercept implicit type conversions, allowing attackers to bypass sandbox protections and execute arbitrary code. - Remediation: Upgrade to Script Security Plugin version 1402.1405.vc96e74964250 or later. 2. Script Security Plugin Script Security Bypass - CVE: CVE-2026-57281 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin versions 1402.v94c9ce464861 and earlier failed to reject certain Groovy AST transformation annotations, allowing attackers to execute scripts outside the sandbox. - Remediation: Upgrade to Script Security Plugin version 1402.1405.vc96e74964250 or later. 3. Git client Plugin Operating System Command Injection - CVE: CVE-2026-57282 - Severity: Medium - Affected Plugin: git-client - Description: Git client Plugin versions 6.6.0 and earlier failed to properly escape working directory names, allowing attackers to inject shell commands. - Remediation: Upgrade to Git client Plugin version 6.6.1 or later. 4. Pipeline: Groovy Plugin CSRF Vulnerability and Unrestricted Type Instantiation - CVE: CVE-2026-57283 (CSRF), CVE-2026-57284 (unrestricted instantiation of types) - Severity: Medium - Affected Plugin: workflow-cps - Description: Pipeline: Groovy Plugin versions 4331.v056fd4658ff and earlier did not restrict instantiable types and contained a CSRF vulnerability. - Remediation: Upgrade to Pipeline: Groovy Plugin version 4331.4333.v50a_b_076c5199 or later. 5. GitHub Branch Source Plugin Missing Permission Check - CVE: CVE-2026-57285 - Severity: Medium - Affected Plugin: github-branch-source - Description: GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier failed to perform permission checks, allowing attackers to enumerate GitHub Enterprise Server URLs. - Remediation: Upgrade to GitHub Branch Source Plugin version 1967.1970.v868979736546 or later. 6. Git Parameter Plugin Missing Permission Check - CVE: CVE-2026-57286 - Severity: Medium - Affected Plugin: git-parameter - Description: Git Parameter Plugin versions 462.vdcf3df2ed2ca_ and earlier failed to perform permission checks, allowing attackers to list SCM branch and tag names. - Remediation: Upgrade to Git Parameter Plugin version 462.463.v496a_59f698e5 or later. 7. Job Configuration History Plugin Encrypted Values Not Redacted - CVE: CVE-2026-57287 - Severity: Medium - Affected Plugin: jobConfigHistory - Description: Job Configuration History Plugin versions 1356.ve360da_6c523a_ and earlier failed to redact encrypted values, allowing attackers to view encrypted keys. - Remediation: Upgrade to Job Configuration History Plugin version 1367.vc8fa_b_15101dc or later. 8. Active Directory Plugin LDAP Injection Vulnerability - CVE: CVE-2026-57288 - Severity: Low - Affected Plugin: active-directory - Description: Active Directory Plugin versions 2.41.1 and earlier failed to escape usernames, allowing attackers to inject LDAP wildcard characters. - Remediation: Upgrade to Active Directory Plugin version 2.41.2 or later. 9. MCP Server Plugin Missing Permission Check - CVE: CVE-2026-57300 - Severity: Medium - Affected Plugin: mcp-server - Description: MCP Server Plugin versions 0.177.v629fdb_2557fe and earlier failed to perform permission checks, allowing attackers to obtain Pipeline scripts. - Remediation: Upgrade to MCP Server Plugin version 0.178.vffe5a_e770f3b_ or later. 10. Bitbucket Push and Pull Request Plugin Unconditional Disabling of SSL/TLS Certificate Validation - CVE: CVE-2026-57289 - Severity: Medium - Affected Plugin: bitbucket-push-and-pull-request - Description: Bitbucket Push and Pull Request Plugin versions 3.3.8 and earlier unconditionally disabled SSL/TLS certificate and hostname verification. - Remediation: Upgrade to Bitbucket Push and Pull Request Plugin version 3.3.9 or later. 11. Priority Sorter Plugin CSRF Vulnerability - CVE: CVE-2026-57290 - Severity: Medium - Affected Plugin: PrioritySorter - Description: Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier did not require POST requests, allowing attackers to overwrite global job priority configurations. - Remediation: Upgrade to Priority Sorter Plugin version 936.937.v5581d0b_2ccb_a_ or later. 12. Gitee Plugin Missing Permission Check and CSRF Vulnerability - CVE: CVE-2026-57291 (missing permission check), CVE-2026-57292 (CSRF) - Severity: Medium - Affected Plugin: gitee - Description: Gitee Plugin versions 1288.v18b_deb_c9069b_ and earlier failed to perform permission checks and contained a CSRF vulnerability. - Remediation: Upgrade to Gitee Plugin version 1292.v2559f2f3fc2c0 or later. 13. Gitee Plugin Incorrect Permission Check - CVE: CVE-2026-57293 - Severity: Medium - Affected Plugin: gitee - Description: Gitee Plugin versions 1288.v18b_d

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Vulnerabilities: RCE, Command Injection, CSRF (CVE-2026-57280 to 57287)