Jenkins Security Advisory 2026-09-02

{
  "id": "be035d97329ade75bd81b81b56765ddfed6b89d4bbb9fe1227ef52bf32ffe013",
  "url": "https://www.jenkins.io/security/advisory/2026-09-02/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2026-09-02",
    "summary": "The advisory reports vulnerabilities across Jenkins, plugins, and update-center2. It provides fixes for affected products, with no fix available for Parameterized Remote Trigger Plugin at publication.",
    "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables: Jenkins (core) Allure Plugin Customizable Header Plugin File Parameter Plugin GitLab Plugin Job Configuration History Plugin LDAP Plugin Microsoft Entra ID (previously Azure AD) Plugin Parameterized Remote Trigger Plugin Performance Plugin Pipeline: Build Step Plugin Pipeline: Groovy Libraries Plugin SAML Plugin Script Security Plugin SonarQube Scanner Plugin ThinBackup Plugin TICS Plugin XebiaLabs XL Deploy Plugin update-center2",
    "products": [
      {
        "name": {
          "value": "Jenkins (core)",
          "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables: Jenkins (core)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.580",
            "evidence": "Jenkins weekly should be updated to version 2.580"
          },
          {
            "value": "2.568.3",
            "evidence": "Jenkins LTS should be updated to version 2.568.3"
          }
        ],
        "affected_versions": [
          {
            "value": "Jenkins weekly up to and including 2.579",
            "evidence": "Jenkins weekly up to and including 2.579"
          },
          {
            "value": "Jenkins LTS up to and including 2.568.2",
            "evidence": "Jenkins LTS up to and including 2.568.2"
          }
        ]
      },
      {
        "name": {
          "value": "Allure Plugin",
          "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables: Jenkins (core) Allure Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.36.0",
            "evidence": "Allure Plugin should be updated to version 2.36.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.35.2",
            "evidence": "Allure Plugin up to and including 2.35.2"
          }
        ]
      },
      {
        "name": {
          "value": "Customizable Header Plugin",
          "evidence": "Customizable Header Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "330.v8a_8d87511ea_1",
            "evidence": "Customizable Header Plugin should be updated to version 330.v8a_8d87511ea_1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 295.v2544b_ca_19b_97",
            "evidence": "Customizable Header Plugin up to and including 295.v2544b_ca_19b_97"
          }
        ]
      },
      {
        "name": {
          "value": "File Parameter Plugin",
          "evidence": "File Parameter Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "433.va_0b_80359d54d",
            "evidence": "File Parameter Plugin should be updated to version 433.va_0b_80359d54d"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 425.v3fa_801681b_5e",
            "evidence": "File Parameter Plugin up to and including 425.v3fa_801681b_5e"
          }
        ]
      },
      {
        "name": {
          "value": "GitLab Plugin",
          "evidence": "GitLab Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.182144.vc1c369226a_52",
            "evidence": "GitLab Plugin should be updated to version 1.9.182144.vc1c369226a_52"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.9.16",
            "evidence": "GitLab Plugin up to and including 1.9.16"
          }
        ]
      },
      {
        "name": {
          "value": "Job Configuration History Plugin",
          "evidence": "Job Configuration History Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1380.v762185b_9a_793",
            "evidence": "Job Configuration History Plugin should be updated to version 1380.v762185b_9a_793"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1367.vc8fa_b_15101dc",
            "evidence": "Job Configuration History Plugin up to and including 1367.vc8fa_b_15101dc"
          }
        ]
      },
      {
        "name": {
          "value": "LDAP Plugin",
          "evidence": "LDAP Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "825.v2fca_37dd5b_cb_",
            "evidence": "LDAP Plugin should be updated to version 825.v2fca_37dd5b_cb_"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 807.809.vd3a_4e5e4ec98",
            "evidence": "LDAP Plugin up to and including 807.809.vd3a_4e5e4ec98"
          }
        ]
      },
      {
        "name": {
          "value": "Microsoft Entra ID (previously Azure AD) Plugin",
          "evidence": "Microsoft Entra ID (previously Azure AD) Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "711.v34046f788fd7",
            "evidence": "Microsoft Entra ID (previously Azure AD) Plugin should be updated to version 711.v34046f788fd7"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 710.v0b_ff8e9cc2d2",
            "evidence": "Microsoft Entra ID (previously Azure AD) Plugin up to and including 710.v0b_ff8e9cc2d2"
          }
        ]
      },
      {
        "name": {
          "value": "Parameterized Remote Trigger Plugin",
          "evidence": "Parameterized Remote Trigger Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 3.2.2",
            "evidence": "Parameterized Remote Trigger Plugin up to and including 3.2.2"
          }
        ]
      },
      {
        "name": {
          "value": "Performance Plugin",
          "evidence": "Performance Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1017.v9e9f7b_b_b_c5e7",
            "evidence": "Performance Plugin should be updated to version 1017.v9e9f7b_b_b_c5e7"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1015.v09ca_52b_3370e",
            "evidence": "Performance Plugin up to and including 1015.v09ca_52b_3370e"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Build Step Plugin",
          "evidence": "Pipeline: Build Step Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "601.v6d4c6d1a_9dc7",
            "evidence": "Pipeline: Build Step Plugin should be updated to version 601.v6d4c6d1a_9dc7"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 599.v4b_67ea_11b_152",
            "evidence": "Pipeline: Build Step Plugin up to and including 599.v4b_67ea_11b_152"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Groovy Libraries Plugin",
          "evidence": "Pipeline: Groovy Libraries Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "805.va_fc79344957d",
            "evidence": "Pipeline: Groovy Libraries Plugin should be updated to version 805.va_fc79344957d"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 798.v5cc688825312",
            "evidence": "Pipeline: Groovy Libraries Plugin up to and including 798.v5cc688825312"
          }
        ]
      },
      {
        "name": {
          "value": "SAML Plugin",
          "evidence": "SAML Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.623.v7875d61cd9f5",
            "evidence": "SAML Plugin should be updated to version 4.623.v7875d61cd9f5"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 4.618.v441a_27fa_46d2",
            "evidence": "SAML Plugin up to and including 4.618.v441a_27fa_46d2"
          }
        ]
      },
      {
        "name": {
          "value": "Script Security Plugin",
          "evidence": "Script Security Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1415.v9a_f9b_3a_c253d",
            "evidence": "Script Security Plugin should be updated to version 1415.v9a_f9b_3a_c253d"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1412.v7737b_3405f86",
            "evidence": "Script Security Plugin up to and including 1412.v7737b_3405f86"
          }
        ]
      },
      {
        "name": {
          "value": "SonarQube Scanner Plugin",
          "evidence": "SonarQube Scanner Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.19.0",
            "evidence": "SonarQube Scanner Plugin should be updated to version 2.19.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.18.3",
            "evidence": "SonarQube Scanner Plugin up to and including 2.18.3"
          }
        ]
      },
      {
        "name": {
          "value": "ThinBackup Plugin",
          "evidence": "ThinBackup Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.1.5",
            "evidence": "ThinBackup Plugin should be updated to version 2.1.5"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.1.4",
            "evidence": "ThinBackup Plugin up to and including 2.1.4"
          }
        ]
      },
      {
        "name": {
          "value": "TICS Plugin",
          "evidence": "TICS Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2026.1.0",
            "evidence": "TICS Plugin should be updated to version 2026.1.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2025.1.1",
            "evidence": "TICS Plugin up to and including 2025.1.1"
          }
        ]
      },
      {
        "name": {
          "value": "XebiaLabs XL Deploy Plugin",
          "evidence": "XebiaLabs XL Deploy Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "26.3.0",
            "evidence": "XebiaLabs XL Deploy Plugin should be updated to version 26.3.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 26.1.0",
            "evidence": "XebiaLabs XL Deploy Plugin up to and including 26.1.0"
          }
        ]
      },
      {
        "name": {
          "value": "update-center2",
          "evidence": "update-center2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.18.4",
            "evidence": "update-center2 should be updated to version 3.18.4"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.18.3",
            "evidence": "update-center2 up to and including 3.18.3"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-84645",
        "evidence": "SECURITY-3972 / CVE-2026-84645"
      },
      {
        "value": "CVE-2026-84646",
        "evidence": "SECURITY-3908 / CVE-2026-84646"
      },
      {
        "value": "CVE-2026-84647",
        "evidence": "SECURITY-3915 / CVE-2026-84647"
      },
      {
        "value": "CVE-2026-84648",
        "evidence": "SECURITY-3967 / CVE-2026-84648"
      },
      {
        "value": "CVE-2026-84649",
        "evidence": "SECURITY-3878 / CVE-2026-84649"
      },
      {
        "value": "CVE-2026-84650",
        "evidence": "SECURITY-4032 / CVE-2026-84650"
      },
      {
        "value": "CVE-2026-84651",
        "evidence": "SECURITY-4025 / CVE-2026-84651"
      },
      {
        "value": "CVE-2026-84652",
        "evidence": "SECURITY-4016 / CVE-2026-84652"
      },
      {
        "value": "CVE-2026-84653",
        "evidence": "SECURITY-3981 / CVE-2026-84653"
      },
      {
        "value": "CVE-2026-84654",
        "evidence": "SECURITY-3926 / CVE-2026-84654"
      },
      {
        "value": "CVE-2026-84655",
        "evidence": "SECURITY-3879 / CVE-2026-84655"
      },
      {
        "value": "CVE-2026-84656",
        "evidence": "SECURITY-4006 / CVE-2026-84656"
      },
      {
        "value": "CVE-2026-84657",
        "evidence": "SECURITY-4015 / CVE-2026-84657"
      },
      {
        "value": "CVE-2026-84658",
        "evidence": "SECURITY-3986 / CVE-2026-84658 (script approval)"
      },
      {
        "value": "CVE-2026-84659",
        "evidence": "CVE-2026-84659 (Groovy sandbox)"
      },
      {
        "value": "CVE-2026-84660",
        "evidence": "SECURITY-3870 / CVE-2026-84660 (build step)"
      },
      {
        "value": "CVE-2026-84661",
        "evidence": "CVE-2026-84661 (waitForBuild step)"
      },
      {
        "value": "CVE-2026-84662",
        "evidence": "SECURITY-3678 / CVE-2026-84662"
      },
      {
        "value": "CVE-2026-84663",
        "evidence": "SECURITY-3815 / CVE-2026-84663"
      },
      {
        "value": "CVE-2026-84664",
        "evidence": "SECURITY-4097 / CVE-2026-84664"
      },
      {
        "value": "CVE-2026-84665",
        "evidence": "SECURITY-3989 / CVE-2026-84665"
      },
      {
        "value": "CVE-2026-84666",
        "evidence": "SECURITY-4098 / CVE-2026-84666"
      },
      {
        "value": "CVE-2026-84667",
        "evidence": "SECURITY-4099 / CVE-2026-84667"
      },
      {
        "value": "CVE-2026-84668",
        "evidence": "SECURITY-4065 / CVE-2026-84668"
      },
      {
        "value": "CVE-2026-84669",
        "evidence": "SECURITY-3645 / CVE-2026-84669"
      },
      {
        "value": "CVE-2026-84670",
        "evidence": "SECURITY-4026 / CVE-2026-84670"
      },
      {
        "value": "CVE-2026-84671",
        "evidence": "SECURITY-4093 / CVE-2026-84671"
      },
      {
        "value": "CVE-2026-84672",
        "evidence": "SECURITY-3935 / CVE-2026-84672"
      },
      {
        "value": "CVE-2026-84673",
        "evidence": "SECURITY-4104 / CVE-2026-84673"
      },
      {
        "value": "CVE-2026-84674",
        "evidence": "SECURITY-3948 / CVE-2026-84674"
      },
      {
        "value": "CVE-2026-84675",
        "evidence": "SECURITY-3987 / CVE-2026-84675"
      },
      {
        "value": "CVE-2026-84676",
        "evidence": "SECURITY-3800 / CVE-2026-84676"
      },
      {
        "value": "CVE-2026-84677",
        "evidence": "SECURITY-4038 / CVE-2026-84677"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23895,
  "published_at": "2026-09-02T12:00:00+00:00"
}