Jenkins Security Bulletin: 9 CVEs across plugins - Sandbox Bypass, SRF, XSS & Fixes

Jenkins Security Advisory 2026-09-16 Vulnerability Overview Jenkins has released a security advisory addressing multiple vulnerabilities across several plugins. The primary types include: Sandbox Bypass (Script Security Plugin): Multiple CVEs, High severity Classpath Approval Bypass (Script Security Plugin): High CVSS score TOCTOU Race Condition (Script Security Plugin): High CVSS score System-Wide Credential Exposure (Pipeline: Multibranch Plugin): Low CVSS score Path Traversal (Pipeline: Groovy Libraries Plugin): Medium CVSS score Server-Side Request Forgery (SSRF) (Gradle Plugin): Medium CVSS score Cache Confusion (GitLab Plugin): Medium CVSS score Stored Cross-Site Scripting (XSS) (Warnings Plugin): High CVSS score Scope of Impact Mitigation Upgrade the affected plugins to the latest versions. Sandbox Bypass: Versions 1415 and earlier of the Script Security Plugin failed to check for calls to methods with the same name; this was fixed in version 1422. Classpath Approval Bypass: Version 1415 allowed configuration updates via the REST API or CLI, bypassing approval; this was fixed in version 1422. TOCTOU Race Condition: Version 1415 allowed the duplicate download of JAR files; this was fixed in version 1422. System-Wide Credential Exposure: Version 841 of the Multibranch Plugin failed to set the correct context; this was fixed in version 842. Path Traversal: Version 805 of Groovy Libraries did not restrict library paths; this was fixed in version 806. SSRF: Version 2.19 of the Gradle Plugin allowed the retrieval of build scan data via the REST API; this was fixed in version 2.20. Cache Confusion: Version 1.2149 of the GitLab Plugin allowed overriding of the globally configured GitLab API token; this was fixed in version 1.2152. Stored XSS: Version 13.10258 of the Warnings Plugin allowed the use of scheme URIs via the REST API; this was fixed in version 13.10259. POC/Exploit Code The page does not contain specific Proof-of-Concept (POC) code or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: 9 CVEs across plugins - Sandbox Bypass, SRF, XSS & Fixes