Jenkins Project
Monthly
Missing authorization checks in Jenkins 2.567 and earlier (LTS 2.555.2 and earlier) expose user-specific configuration data to any authenticated user holding the Overall/Read permission. Authenticated low-privilege users can query the timezone setting of any Jenkins user account and enumerate the names of views configured within other users' 'My Views' personal dashboards, constituting an information disclosure weakness. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, placing real-world risk in the low-moderate tier primarily relevant to multi-tenant or shared Jenkins deployments.
Missing authorization enforcement in Jenkins allows low-privileged authenticated users to cancel build queue items they lack permission to view. Affecting Jenkins 2.567 and earlier (LTS 2.555.2 and earlier), this CWE-862 flaw breaks the expected access control invariant that Item/Cancel should be constrained by Item/Read visibility. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity and network accessibility make it a realistic threat in multi-tenant Jenkins deployments where fine-grained RBAC is in use.
Open redirect in Jenkins login flow enables phishing attacks by exploiting improper redirect URL validation. Tab or newline characters injected between `//` in a post-login redirect URL bypass Jenkins' legitimacy check, redirecting authenticated victims to attacker-controlled sites. Affects Jenkins weekly 2.567 and earlier and LTS 2.555.2 and earlier; vendor-released patches are available. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the bypass technique is trivially derivable from the public advisory.
Open redirect exploitation in Jenkins allows unauthenticated network attackers to craft login URLs that bypass the post-authentication redirect validation and forward users to attacker-controlled external sites. Affected are Jenkins weekly releases through 2.567 and LTS releases through 2.555.2, where the redirect URL legitimacy check fails when the URL contains relative path segments such as `./` or `../`. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, placing this in a moderate-risk, phishing-enablement category rather than a direct system compromise class.
Open redirect in the Jenkins Microsoft Entra ID Plugin (formerly Azure AD Plugin) version 666.v6060de32f87d and earlier allows network-accessible phishing attacks against Jenkins users. The plugin fails to validate the post-login redirect URL, enabling an attacker to craft a legitimate-looking Jenkins authentication link that silently forwards victims to an attacker-controlled site after successful Entra ID login. No active exploitation is confirmed (SSVC: none; EPSS 0.03%, 8th percentile), and the vendor has released a patch per the April 2026 Jenkins security advisory.
Missing authorization (CWE-862) in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows any authenticated user with only Overall/Read permission to force the Jenkins server to initiate outbound connections to an arbitrary attacker-controlled URL using attacker-supplied GitHub App credentials. This SSRF-adjacent capability enables abuse of Jenkins as an unauthorized network proxy and may expose internal network topology to external actors. No public exploit has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (7th percentile) and SSVC exploitation status of 'none' confirm low near-term exploitation likelihood, though the low privilege barrier makes it accessible to any credentialed Jenkins user.
Unsafe deserialization in Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allows an authenticated user with Item/Configure permission to instantiate arbitrary Java classes from the Jenkins classpath by specifying class names in job configuration. The vulnerability arises because the plugin invokes parameterless constructors of user-specified classes when deserializing inheritance strategies without type restriction. No public exploit is identified at time of analysis, and SSVC signals exploitation as none, but the real-world impact depends on the richness of the Jenkins classpath - gadget classes available in that environment determine the attacker's effective reach.
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.
The Jenkins LoadNinja Plugin version 2.1 and earlier fails to mask LoadNinja API keys displayed on the job configuration form, allowing attackers with access to the Jenkins web interface to observe and capture sensitive credentials. This information disclosure vulnerability affects Jenkins administrators and users with job configuration visibility, enabling credential theft that could lead to unauthorized access to LoadNinja services and associated testing infrastructure. No CVSS score, EPSS data, or active exploitation status (KEV listing) is currently available in public sources.
The Jenkins LoadNinja Plugin versions 2.1 and earlier stores LoadNinja API keys in plaintext within job configuration files (config.xml) on the Jenkins controller, allowing unauthorized disclosure of sensitive credentials. Users with Item/Extended Read permission on Jenkins jobs or direct file system access to the controller can extract these API keys, potentially leading to account compromise and unauthorized access to LoadNinja services. This is a straightforward credential exposure vulnerability with no complexity barriers to exploitation once access is gained.
Missing authorization checks in Jenkins 2.567 and earlier (LTS 2.555.2 and earlier) expose user-specific configuration data to any authenticated user holding the Overall/Read permission. Authenticated low-privilege users can query the timezone setting of any Jenkins user account and enumerate the names of views configured within other users' 'My Views' personal dashboards, constituting an information disclosure weakness. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, placing real-world risk in the low-moderate tier primarily relevant to multi-tenant or shared Jenkins deployments.
Missing authorization enforcement in Jenkins allows low-privileged authenticated users to cancel build queue items they lack permission to view. Affecting Jenkins 2.567 and earlier (LTS 2.555.2 and earlier), this CWE-862 flaw breaks the expected access control invariant that Item/Cancel should be constrained by Item/Read visibility. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity and network accessibility make it a realistic threat in multi-tenant Jenkins deployments where fine-grained RBAC is in use.
Open redirect in Jenkins login flow enables phishing attacks by exploiting improper redirect URL validation. Tab or newline characters injected between `//` in a post-login redirect URL bypass Jenkins' legitimacy check, redirecting authenticated victims to attacker-controlled sites. Affects Jenkins weekly 2.567 and earlier and LTS 2.555.2 and earlier; vendor-released patches are available. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the bypass technique is trivially derivable from the public advisory.
Open redirect exploitation in Jenkins allows unauthenticated network attackers to craft login URLs that bypass the post-authentication redirect validation and forward users to attacker-controlled external sites. Affected are Jenkins weekly releases through 2.567 and LTS releases through 2.555.2, where the redirect URL legitimacy check fails when the URL contains relative path segments such as `./` or `../`. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, placing this in a moderate-risk, phishing-enablement category rather than a direct system compromise class.
Open redirect in the Jenkins Microsoft Entra ID Plugin (formerly Azure AD Plugin) version 666.v6060de32f87d and earlier allows network-accessible phishing attacks against Jenkins users. The plugin fails to validate the post-login redirect URL, enabling an attacker to craft a legitimate-looking Jenkins authentication link that silently forwards victims to an attacker-controlled site after successful Entra ID login. No active exploitation is confirmed (SSVC: none; EPSS 0.03%, 8th percentile), and the vendor has released a patch per the April 2026 Jenkins security advisory.
Missing authorization (CWE-862) in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows any authenticated user with only Overall/Read permission to force the Jenkins server to initiate outbound connections to an arbitrary attacker-controlled URL using attacker-supplied GitHub App credentials. This SSRF-adjacent capability enables abuse of Jenkins as an unauthorized network proxy and may expose internal network topology to external actors. No public exploit has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (7th percentile) and SSVC exploitation status of 'none' confirm low near-term exploitation likelihood, though the low privilege barrier makes it accessible to any credentialed Jenkins user.
Unsafe deserialization in Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allows an authenticated user with Item/Configure permission to instantiate arbitrary Java classes from the Jenkins classpath by specifying class names in job configuration. The vulnerability arises because the plugin invokes parameterless constructors of user-specified classes when deserializing inheritance strategies without type restriction. No public exploit is identified at time of analysis, and SSVC signals exploitation as none, but the real-world impact depends on the richness of the Jenkins classpath - gadget classes available in that environment determine the attacker's effective reach.
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.
The Jenkins LoadNinja Plugin version 2.1 and earlier fails to mask LoadNinja API keys displayed on the job configuration form, allowing attackers with access to the Jenkins web interface to observe and capture sensitive credentials. This information disclosure vulnerability affects Jenkins administrators and users with job configuration visibility, enabling credential theft that could lead to unauthorized access to LoadNinja services and associated testing infrastructure. No CVSS score, EPSS data, or active exploitation status (KEV listing) is currently available in public sources.
The Jenkins LoadNinja Plugin versions 2.1 and earlier stores LoadNinja API keys in plaintext within job configuration files (config.xml) on the Jenkins controller, allowing unauthorized disclosure of sensitive credentials. Users with Item/Extended Read permission on Jenkins jobs or direct file system access to the controller can extract these API keys, potentially leading to account compromise and unauthorized access to LoadNinja services. This is a straightforward credential exposure vulnerability with no complexity barriers to exploitation once access is gained.