Multiple Jenkins plugin flaws enable RCE, XSS and phishing

Affected Environment
Jenkins deployments using specific versions of Credentials Binding, GitHub, GitHub Branch Source, HTML Publisher, Matrix Authorization, Microsoft Entra ID and Script Security plugins. Exposure applies where these plugins are installed at or below the listed vulnerable versions and have not yet been updated to the fixed releases.

Threat Overview
Multiple plugin flaws enable remote code execution, information disclosure, unauthorized access, stored XSS and phishing via open redirect. Risk is rated Critical for government and business entities of all sizes due to potential compromise of build infrastructure and related assets.

Exposure Timeline
Vulnerabilities were disclosed in the Jenkins security advisory dated 29 April 2026, with this threat report issued 30 April 2026. Organizations are advised to assess impact and apply patches within approximately ten working days to reduce exposure before broad exploitation.

Attack Surface
Attackers require access to Jenkins with permissions such as Overall/Read, Item/Configure, or the ability to supply credentials to jobs or configure plugins. Exposed instances include internet-facing or internally accessible Jenkins where these plugins are active and user permissions are not tightly restricted.

Technical Root Cause
Issues include missing permission checks, path traversal on credential file names, unsafe deserialization, improper URL handling and unescaped user-controlled fields. These flaws in plugin input validation and authorization controls allow unintended file writes, arbitrary connections, type instantiation, XSS and redirects.

Exploitation Pathway
An attacker with low to moderate Jenkins privileges can trigger vulnerable endpoints, supply crafted inputs, or configure jobs using malicious data. Successful exploitation may lead to writing files on nodes, executing code, exfiltrating information, injecting scripts, or redirecting users to phishing sites.