Jenkins Security Bulletin: Multiple Plugin RCE/SSRF/Cred Enum Vulns

Jenkins Security Advisory 2026-08-05 Vulnerability Summary Vulnerability Overview This advisory covers multiple security vulnerabilities in Jenkins and its plugins, primarily including: 1. Agent-to-controller deserialization filter bypass 2. Exploits allowing arbitrary file creation 3. Path traversal vulnerability in file parameters 4. Improper case-sensitivity handling leading to privilege escalation 5. Users with Overall/Manage permissions can instantiate any configuration-related type 6. Arbitrary code execution vulnerability in the Multijob plugin 7. CSRF vulnerability in the Multijob plugin allowing arbitrary code execution 8. Missing permission check in the HCL AppScan plugin allowing enumeration of credential IDs 9. CSRF and missing permission check in the SCM-Manager plugin 10. Missing permission check in the External Workspace Manager plugin allowing reading of workspace files 11. Non-constant-time webhook token comparison in the Webhook Secret Credentials Provider plugin 12. Missing permission check in the Parameterized Remote Trigger plugin allowing enumeration of credential IDs 13. Missing permission check in the XML Job to Job DSL plugin 14. Stored XSS vulnerability in the Qualys Container Scanning Connector plugin 15. Stored XSS vulnerability in the Summary Display plugin 16. Exposure of system-wide credentials in the Google Chat Notification plugin 17. Exposure of system-wide credentials in the Horreum plugin 18. Missing permission check in the Violation Comments to GitLab plugin allowing enumeration of credential IDs 19. Missing permission check in the Sauce OnDemand plugin allowing enumeration of credential IDs 20. Missing permission check in the CodeSonar plugin allowing enumeration of credential IDs 21. Missing permission check in the AWS CodeBuild plugin allowing enumeration of credential IDs 22. XXE vulnerability in the Ivy Report plugin Affected Scope Jenkins Core: Versions 2.575 and earlier, LTS 2.568.1 and earlier Plugins: - AWS CodeBuild Plugin 0.59 and earlier - CodeSonar Plugin 3.6.0 and earlier - External Workspace Manager Plugin 1.4.1 and earlier - Google Chat Notification Plugin 166.ve8b_dc280f28 and earlier - HCL AppScan Plugin 1.8.3 and earlier - Horreum Plugin 0.16.162.v3b_4a_a_b_5828 and earlier - Ivy Report Plugin 1.2 and earlier - Multijob Plugin 669.v9d96a_d8c71b_0 and earlier - Parameterized Remote Trigger Plugin 3.2.2 and earlier - Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier - Sauce OnDemand Plugin 2.2.0 and earlier - SCM-Manager Plugin 1.11.1 and earlier - Summary Display Plugin 1.15 and earlier - Violation Comments to GitLab Plugin 2.62.0 and earlier - Webhook Secret Credentials Provider Plugin 16.v0cfa_80215cf5 and earlier - XML Job to Job DSL Plugin 0.1.13 and earlier Remediation Jenkins Core: Upgrade to 2.576 or LTS 2.568.2 Plugins: Upgrade to their respective secure versions - AWS CodeBuild Plugin 0.59 to 0.60 or later - CodeSonar Plugin 3.6.0 to 3.6.1 or later - External Workspace Manager Plugin 1.4.1 to 1.4.2 or later - Google Chat Notification Plugin 166.ve8b_dc280f28 to 166.ve8b_dc280f29 or later - HCL AppScan Plugin 1.8.3 to 1.8.4 or later - Horreum Plugin 0.16.162.v3b_4a_a_b_5828 to 0.16.162.v3b_4a_a_b_5829 or later - Ivy Report Plugin 1.2 to 1.3 or later - Multijob Plugin 669.v9d96a_d8c71b_0 to 669.v9d96a_d8c71b_1 or later - Parameterized Remote Trigger Plugin 3.2.2 to 3.2.3 or later - Qualys Container Scanning Connector Plugin 1.8.0.5 to 1.8.0.6 or later - Sauce OnDemand Plugin 2.2.0 to 2.2.1 or later - SCM-Manager Plugin 1.11.1 to 1.12.1 or later - Summary Display Plugin 1.15 to 1.16 or later - Violation Comments to GitLab Plugin 2.62.0 to 2.63.0 or later - Webhook Secret Credentials Provider Plugin 16.v0cfa_80215cf5 to 32.v09c9b_522f0a_b_8 or later - XML Job to Job DSL Plugin 0.1.13 to 0.1.14 or later POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Additional Information This advisory was reported via the Jenkins Bug Bounty Program and sponsored by the European Commission. Some vulnerabilities do not have a remediation solution; users are advised to refer to the relevant GitHub repositories for more information. --- The above is a summary of key vulnerabilities from the Jenkins Security Advisory 2026-08-05.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Multiple Plugin RCE/SSRF/Cred Enum Vulns