What is the CVSS score of CVE-2026-42523?

CVE-2026-42523 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jenkins Github Plugin are affected by CVE-2026-42523?

Jenkins GitHub Plugin versions 1.46.0 and earlier contain a stored cross-site scripting vulnerability that allows low-privileged authenticated users to escalate privileges through malicious…. A patch is available.

How to fix or mitigate CVE-2026-42523?

Within 24 hours, inventory all Jenkins instances and identify those running GitHub Plugin version 1.46.0 or earlier. Within 7 days, apply the vendor-released patch to upgrade GitHub Plugin to version 1.46.1 or later across all identified instances and verify successful deployment. Within 30 days, conduct a targeted access review to audit which users hold Overall/Read permission levels and remove unnecessary privileges in accordance with least-privilege policy.

Jenkins Github Plugin CVE-2026-42523

EUVD-2026-26225 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-29 jenkins

GHSA-w22p-4x9f-486v

XSS Jenkins Jenkins Github Plugin Jenkins Project

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:54 vuln.today

CVSS changed

Apr 29, 2026 - 15:22 NVD

9.0 (None) 9.0 (CRITICAL)

EUVD ID Assigned

Apr 29, 2026 - 14:00 euvd

EUVD-2026-26225

CVE Published

Apr 29, 2026 - 13:31 nvd

CRITICAL 9.0

DescriptionCVE.org

Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.

AnalysisAI

Stored cross-site scripting in the Jenkins GitHub Plugin (versions ≤ 1.46.0) lets a low-privileged authenticated user with Overall/Read permission inject JavaScript by controlling the current job URL, which is unsafely embedded into the client-side validation logic for the 'GitHub hook trigger for GITScm polling' feature. When another user — potentially a Jenkins administrator — views the affected page, the attacker's script executes inside their authenticated Jenkins session. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but the CVSS 9.0 rating and scope-changed impact make it a meaningful CI/CD privilege-escalation surface.