Jenkins: 25 Vulnerabilities Disclosed Together, Including RCE and XSS Flaws
Jenkins Project disclosed 25 vulnerabilities on September 2, 2026, including high-severity flaws like RCE and XSS, affecting core and plugins.
Key findings
- 25 Jenkins vulnerabilities disclosed on September 2, 2026, covering RCE, XSS, and permission bypasses.
- High-severity flaws include insecure deserialization and Stapler component exploits leading to RCE.
- Multiple plugins and Jenkins core affected, with issues ranging from command injection to CSRF.
- All vulnerabilities patched in Jenkins core 2.580 and LTS 2.568.3; immediate update recommended.
- Key vulnerability themes include Stapler data binding exploits and insecure deserialization.
- Permission check bypasses impact critical functions like build cancellation and credential access.
On September 2, 2026, the Jenkins Project disclosed a significant batch of 25 vulnerabilities affecting its core platform and various plugins. These vulnerabilities, ranging in severity from medium to high, were all published within a narrow timeframe, indicating a coordinated disclosure event. The disclosures highlight issues across multiple components, including cross-site scripting (XSS), OS command injection, insecure deserialization, and permission check bypasses, underscoring the need for prompt patching and security review for Jenkins users.
Several vulnerabilities stem from improper handling of user-supplied data or insecure configurations. For instance, CVE-2026-84677 involves a stored XSS vulnerability in the update-center2 component due to unescaped plugin metadata. Similarly, CVE-2026-84673 in the Customizable Header Plugin allows attackers to inject JavaScript via custom SVG icons, and CVE-2026-84665 in the SonarQube Scanner Plugin enables XSS through specially crafted dashboard links.
A notable theme among the disclosures involves insecure deserialization and Stapler component vulnerabilities, some carrying a high severity rating (CVSSv3 8.8). CVE-2026-84670 in the Performance Plugin allows arbitrary code execution due to insecure deserialization of cached performance reports. CVE-2026-84671 in the File Parameter Plugin permits arbitrary file writes on the controller's file system, potentially leading to remote code execution. CVE-2026-84668 in the SAML Plugin allows attackers to overwrite SAML metadata, enabling authentication as any user.
Permission check bypasses are another recurring issue. CVE-2026-84674 in the XebiaLabs XL Deploy Plugin allows enumeration of credentials IDs. CVE-2026-84672 in the Microsoft Entra ID Plugin could lead to unauthorized permission grants by exploiting display name collisions. CVE-2026-84657 and CVE-2026-84660 in the Pipeline: Build Step Plugin, and CVE-2026-84657 in Jenkins core, allow for the cancellation of builds without proper authorization. CVE-2026-84656 permits unauthorized access to build parameter names and values.
Other vulnerabilities include OS command injection in the TICS Plugin (CVE-2026-84675), path traversal in the Allure Plugin (CVE-2026-84669), insecure storage of tokens in the Parameterized Remote Trigger Plugin (CVE-2026-84676), and CSRF in the Pipeline: Groovy Libraries Plugin (CVE-2026-84663). The Jenkins core itself is affected by issues related to build CLI commands (CVE-2026-84657), build parameter access (CVE-2026-84656), JSON/Python serialization (CVE-2026-84655), and appearance configuration (CVE-2026-84653).
According to the Jenkins Security Advisory, all these vulnerabilities have been addressed in Jenkins core version 2.580 and LTS 2.568.3. Users are strongly advised to update to these versions to mitigate the risks associated with this extensive batch of security flaws.
This coordinated disclosure event underscores the importance of maintaining up-to-date Jenkins instances and regularly reviewing plugin security. The variety of vulnerabilities, from XSS to RCE and permission escalations, highlights the multifaceted attack surface Jenkins presents and the critical need for timely patching to protect CI/CD pipelines and sensitive data.
The Jenkins Project has released security advisories detailing each vulnerability and the corresponding fixed versions. Users should consult the official Jenkins Security Advisory for 2026-09-02 for comprehensive information and remediation steps.
Key findings include:
- A large batch of 25 vulnerabilities affecting Jenkins core and plugins was disclosed on September 2, 2026.
- High-severity flaws include RCE via insecure deserialization and file writes, and authentication bypasses.
- Multiple XSS vulnerabilities were found across different plugins and core components.
- Permission check bypasses affect critical operations like build cancellation and credential access.
- All disclosed vulnerabilities are addressed in Jenkins core 2.580 and LTS 2.568.3.
- Users are urged to update immediately to secure their Jenkins environments.
- The vulnerabilities span various bug classes including XSS, RCE, command injection, path traversal, and CSRF.
- Stapler component issues and insecure deserialization are recurring themes in this disclosure batch.