Jenkins Plugins: 20 Vulnerabilities Disclosed, Script Security Plugin at High Risk
Jenkins Project disclosed 20 vulnerabilities on September 16, 2026, affecting multiple plugins, with severe risks including code execution and XSS.
Key findings
- 20 Jenkins plugins affected by vulnerabilities disclosed on September 16, 2026.
- Multiple XSS vulnerabilities present in plugins like Gitee, OWASP Dependency-Check, Coverage, and Warnings.
- High-severity sandbox bypasses in Script Security Plugin allow arbitrary code execution.
- Vulnerabilities include open redirects, credential theft, path traversal, and OAuth flow hijacking.
- All affected plugins have corresponding security updates available.
On September 16, 2026, the Jenkins Project disclosed a significant batch of 20 vulnerabilities affecting various plugins, with a particular emphasis on the Script Security Plugin. This coordinated disclosure event highlights potential risks for Jenkins users, ranging from phishing attacks and credential theft to arbitrary code execution.
Several plugins were impacted by vulnerabilities that could lead to cross-site scripting (XSS) attacks. The Gitee Plugin (CVE-2026-92140) and OWASP Dependency-Check Plugin (CVE-2026-92136) are susceptible to stored XSS due to improper escaping of user-supplied data in build causes and Dependency-Check reports, respectively. Similarly, the Coverage Plugin (CVE-2026-92135) and Warnings Plugin (CVE-2026-92134) suffer from stored XSS when job configurations are submitted via the REST API, allowing attackers to inject malicious JavaScript via specially crafted URLs.
The Jenkins Script Security Plugin was at the center of a cluster of high-severity vulnerabilities, many of which allow for sandbox bypass and arbitrary code execution. These include issues related to dynamically added methods (CVE-2026-92129), double JAR downloads (CVE-2026-92128), automatic approval of classpath entries (CVE-2026-92127), improper handling of @Builder annotations (CVE-2026-92126), and the acceptance of @GroovyASTTransformationClass annotations (CVE-2026-92125). Further bypasses were identified through type casting collections (CVE-2026-92124), operations on null receivers (CVE-2026-92123), and method coercion through proxies (CVE-2026-92122). These vulnerabilities collectively undermine the sandbox's ability to protect the Jenkins controller from malicious code execution.
Other notable vulnerabilities include an open redirect in the Keycloak Authentication Plugin (CVE-2026-92141), which could facilitate phishing attacks. The Bitbucket Push and Pull Request Plugin (CVE-2026-92139) is vulnerable to credential theft via crafted webhook payloads, while the Bitbucket Server Integration Plugin (CVE-2026-92138) allows for OAuth flow hijacking. Path traversal vulnerabilities were found in the Pipeline: Groovy Libraries Plugin (CVE-2026-92131), and credential leakage risks exist in the Pipeline: Multibranch Plugin (CVE-2026-92130) and GitLab Plugin (CVE-2026-92133). The Gradle Plugin (CVE-2026-92132) could expose Develocity access keys under certain conditions.
The Jenkins Project addressed these vulnerabilities through updates to the affected plugins. Users are strongly advised to consult the official Jenkins security advisory for detailed information on affected versions and the corresponding patched releases. Promptly updating these plugins is crucial to mitigate the risks associated with these security flaws.
This extensive batch of vulnerabilities underscores the importance of maintaining up-to-date Jenkins instances and regularly reviewing plugin security. The concentration of high-severity flaws in the Script Security Plugin, in particular, warrants immediate attention from administrators managing Jenkins environments where user-provided scripts or pipelines are executed.
The Jenkins Project released updates for all affected plugins on September 16, 2026, to address these vulnerabilities.
Key findings include:
- A significant batch of 20 CVEs disclosed on September 16, 2026, impacting multiple Jenkins plugins.
- Multiple stored XSS vulnerabilities found in plugins like Gitee, OWASP Dependency-Check, Coverage, and Warnings.
- Numerous high-severity sandbox bypasses in the Script Security Plugin enabling arbitrary code execution.
- Vulnerabilities include open redirects, credential theft, path traversal, and OAuth flow hijacking.
- All affected plugins have been updated; users should consult the Jenkins security advisory for details.