EUVD-2026-70114
GHSA-qgwr-f9q8-fxgq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
PR:L because attacker must control an agent process; S:C reflects XSS executing in the victim's browser context; A:N as XSS carries no direct application availability impact.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
Articles & Coverage 2
AnalysisAI
Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control a Jenkins agent process connected to the target controller - achieved by compromising an existing build node (via a malicious pipeline script, vulnerable build dependency, or CI/CD supply-chain attack), registering a rogue agent if the instance is configured to accept unauthenticated JNLP/WebSocket agent connections, or through insider access to a build machine. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) merits scrutiny on the PR:N metric: the described exploit path explicitly requires the attacker to 'control agent processes', implying at minimum a compromised build host, a rogue agent accepted by the controller, or insider access - not a zero-prior-access network attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Jenkins to version 2.580 (weekly) or 2.568.3 (LTS) as the primary remediation, per the vendor advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3967. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Jenkins instances running version 2.579 or earlier and assess the trust level and external connectivity of agent processes in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today