Do Son 
The Jenkins project has released a security advisory, addressing several vulnerabilities across its plugin ecosystem. The fixes cover a range of threats, from remote code execution (RCE) and path traversal to stored cross-site scripting (XSS), affecting thousands of CI/CD environments.
Track every Jenkins CVE the moment it's exploited.
Get free email alertsThe most critical fixes involve plugins that handle external credentials and job publishing, where simple oversight could lead to full system compromise.
- RCE via Credentials Binding (CVE-2026-42520): This “High” severity path traversal flaw exists because the plugin fails to sanitize file names for zip or file credentials. If a low-privileged user configures these for a job on a built-in node, it can lead to remote code execution.
- Stored XSS in GitHub Plugin (CVE-2026-42523): Attackers with “Overall/Read” permissions could exploit improper processing of job URLs to execute malicious JavaScript.
- Legacy Wrapper XSS in HTML Publisher (CVE-2026-42524): A failure to escape job names and URLs in legacy wrapper files allowed attackers with “Item/Configure” permissions to launch stored XSS attacks.
The advisory also highlighted several Medium Severity issues that could allow attackers to gather intelligence or manipulate users.
| Plugin | Vulnerability | Impact |
| Script Security |
Missing Permission Check |
Attackers can enumerate pending and approved classpaths. |
| Matrix Auth |
Unsafe Deserialization |
Misuse of constructors can lead to information disclosure. |
| Microsoft Entra ID |
Open Redirect |
Facilitates phishing by forwarding users to malicious sites after login. |
| GitHub Branch Source |
Missing Permission Check |
Allows unauthorized connection tests to specified URLs. |
Jenkins has released updated versions for all affected plugins to mitigate these risks. Administrators are urged to verify their plugin versions against the following table and upgrade immediately:
- Credentials Binding Plugin: Upgrade to version 720.v3f6decef43ea_ or later.
- GitHub Plugin: Upgrade to version 1.46.0.1 or later.
- HTML Publisher Plugin: Upgrade to version 427.1 or later.
- Matrix Authorization Strategy Plugin: Upgrade to version 3.2.10 or later.
- Microsoft Entra ID Plugin: Upgrade to version 667.v4c5827a_e74a_0 or later.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
