Multiple Vulnerabilities in Jenkins

Affected Environment

Jenkins weekly and LTS core, plus Multijob, HCL AppScan, SCM-Manager, and several other plugins with active use.

Threat Overview

Vulnerabilities enable arbitrary code execution, unauthorized access, privilege escalation, information disclosure, and cross-site request forgery attacks.

Exposure Timeline

Disclosed 5th August 2026; several plugins remain unpatched, with Jenkins core and LTS fixes available now.

Attack Surface

Agent-to-controller communication, file parameter handling, HTTP endpoints, and Groovy scripting features exposed to authenticated users.

Technical Root Cause

Deserialization filter gaps, unsafe symbolic link handling, path traversal flaws, and missing permission checks across plugins.

Exploitation Pathway

Attackers with agent access or specific permissions bypass filters, write arbitrary files, or execute unsandboxed Groovy code.