Jenkins XSS and Build Info Disclosure Flaws

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

High

CVE-2026-27099, CVE-2026-27100

Jenkins

February 19, 2026

Executive Summary

Stored XSS (CVE-2026-27099) and build metadata disclosure (CVE-2026-27100) allow script injection or inference of internal job details.

Key Details

Affected Platform

Jenkins

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Jenkins weekly versions 2.483–2.550 and LTS 2.492.1–2.541.1, particularly multi-user or externally accessible CI/CD environments.

Operational Impact

Stored XSS (CVSS 8.0) risks session hijacking and admin abuse; disclosure flaw (CVSS 4.3) supports reconnaissance of CI/CD pipelines.

Technical Root Cause

Failure to escape user input enables stored XSS; inadequate validation of Run Parameters permits internal job and build enumeration.

Recommended Mitigation

Upgrade weekly to 2.551 and LTS to 2.541.2; enforce least privilege for Agent and Item permissions.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Jenkins Security Advisory (18 Feb 2026)
https://www.jenkins.io/security/advisory/2026-02-18/