Jenkins Multi-Component Security Bulletin

The following is a summary of key vulnerability information based on the provided webpage screenshot: --- Jenkins Security Advisory 2026-08-05 Vulnerability Overview This advisory covers security vulnerabilities in multiple Jenkins components, including core components and plugins. The main issues include: 1. Deserialization Filter Bypass: Attackers can bypass the JEP-200 deserialization filter through specific paths. 2. Symlink Vulnerability: Allows arbitrary file creation. 3. Path Traversal Vulnerability: Allows writing files to arbitrary locations. 4. Improper Case-Sensitivity Handling: May lead to privilege escalation. 5. Configuration Instantiation Vulnerability: Allows non-administrators to instantiate arbitrary types. 6. Groovy Script Execution Vulnerability: Allows arbitrary code execution. 7. CSRF Vulnerability: Allows Cross-Site Request Forgery. 8. Missing Permission Checks: Allows enumeration of credential IDs or reading workspace files. 9. Webhook Token Comparison Vulnerability: May lead to token leakage. 10. Stored XSS Vulnerability: Allows execution of malicious scripts. 11. System-wide Credential Exposure: Allows usage of system-wide credentials. --- Scope of Impact Jenkins Core: Versions 2.575 and earlier, LTS 2.568.1 and earlier. Plugins: - Jenkins Multijob Plugin (669.9d996a_d9c71b_0 and earlier) - HCL AppScan Plugin (1.8.3 and earlier) - SCM-Manager Plugin (1.11.1 and earlier) - External Workspace Manager Plugin (1.4.1 and earlier) - Webhook Secret Credentials Provider Plugin (16.v0cf_a0215cf5 and earlier) - Parameterized Remote Trigger Plugin (3.2.2 and earlier) - XML Job to Job DSL Plugin (0.1.13 and earlier) - Qualys Container Scanning Connector Plugin (1.8.0.5 and earlier) - Summary Display Plugin (1.15 and earlier) - Google Chat Notification Plugin (166.ve6b_de280f2e8 and earlier) --- Remediation 1. Jenkins Core: - Upgrade to Jenkins 2.576 or LTS 2.568.2. - For the Remoting library, upgrade to version 3384.v60d89463d9e0 or higher. 2. Plugins: - Jenkins Multijob Plugin: Upgrade to 677.v7ffc23d6a_4c2. - HCL AppScan Plugin: Upgrade to 1.8.4. - SCM-Manager Plugin: Upgrade to 1.12.1. - External Workspace Manager Plugin: Upgrade to 1.4.2. - Webhook Secret Credentials Provider Plugin: Upgrade to 32.v09cb_522f0a_8. - Parameterized Remote Trigger Plugin: No patched version available. - XML Job to Job DSL Plugin: No patched version available. - Qualys Container Scanning Connector Plugin: No patched version available. - Summary Display Plugin: No patched version available. - Google Chat Notification Plugin: No patched version available. --- POC Code or Exploit Code No specific POC code or exploit code was provided on the page. --- Other Information Some vulnerabilities were reported via the Jenkins Bug Bounty Program. Remediation for certain vulnerabilities depends on manual configuration or plugin upgrades by users. --- The above is a summary of the key information regarding the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Multi-Component Security Bulletin