Jenkins Security Advisory 2026-09-16

{
  "id": "2aff0276e3a08d870e098933a8c55af50a257134f2b4bf30a031ab9959040d3b",
  "url": "https://www.jenkins.io/security/advisory/2026-09-16/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2026-09-16",
    "summary": "The advisory reports vulnerabilities in 13 Jenkins plugins and provides fixed versions. It also notes required attacker permissions or other conditions for exploitation in several cases.",
    "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables: Bitbucket Push and Pull Request Plugin Bitbucket Server Integration Plugin Coverage Plugin Gitee Plugin GitLab Plugin Gradle Plugin Keycloak Authentication Plugin OWASP Dependency-Check Plugin Pipeline: Groovy Libraries Plugin Pipeline: Multibranch Plugin Robot Framework Plugin Script Security Plugin Warnings Plugin",
    "products": [
      {
        "name": {
          "value": "Bitbucket Push and Pull Request Plugin",
          "evidence": "Bitbucket Push and Pull Request Plugin should be updated to version 4.1.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.1.0",
            "evidence": "Bitbucket Push and Pull Request Plugin should be updated to version 4.1.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 4.0.1",
            "evidence": "Bitbucket Push and Pull Request Plugin up to and including 4.0.1"
          }
        ]
      },
      {
        "name": {
          "value": "Bitbucket Server Integration Plugin",
          "evidence": "Bitbucket Server Integration Plugin should be updated to version 6.0.2"
        },
        "prerequisites": [
          {
            "value": "Exploiting this vulnerability requires the attacker to have previously registered an OAuth consumer (requires Overall/Administer permission) and to be able to intercept and modify the victim’s form submission.",
            "evidence": "Exploiting this vulnerability requires the attacker to have previously registered an OAuth consumer (requires Overall/Administer permission) and to be able to intercept and modify the victim’s form submission."
          }
        ],
        "fixed_versions": [
          {
            "value": "6.0.2",
            "evidence": "Bitbucket Server Integration Plugin should be updated to version 6.0.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 6.0.1",
            "evidence": "Bitbucket Server Integration Plugin up to and including 6.0.1"
          }
        ]
      },
      {
        "name": {
          "value": "Coverage Plugin",
          "evidence": "Coverage Plugin should be updated to version 3.3361.v0626103a_67e6"
        },
        "prerequisites": [
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability."
          }
        ],
        "fixed_versions": [
          {
            "value": "3.3361.v0626103a_67e6",
            "evidence": "Coverage Plugin should be updated to version 3.3361.v0626103a_67e6"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.3358.v9487dde48783",
            "evidence": "Coverage Plugin up to and including 3.3358.v9487dde48783"
          }
        ]
      },
      {
        "name": {
          "value": "Gitee Plugin",
          "evidence": "Gitee Plugin should be updated to version 1304.v2702f1d71cde"
        },
        "prerequisites": [
          {
            "value": "attackers able to trigger builds via the Gitee Plugin webhook endpoint",
            "evidence": "This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Gitee Plugin webhook endpoint."
          }
        ],
        "fixed_versions": [
          {
            "value": "1304.v2702f1d71cde",
            "evidence": "Gitee Plugin should be updated to version 1304.v2702f1d71cde"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1301.v8957053c7902",
            "evidence": "Gitee Plugin up to and including 1301.v8957053c7902"
          }
        ]
      },
      {
        "name": {
          "value": "GitLab Plugin",
          "evidence": "GitLab Plugin should be updated to version 1.2152.veec0897048b_0"
        },
        "prerequisites": [
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.2152.veec0897048b_0",
            "evidence": "GitLab Plugin should be updated to version 1.2152.veec0897048b_0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.2149.vcfc32c82b_f7f",
            "evidence": "GitLab Plugin up to and including 1.2149.vcfc32c82b_f7f"
          }
        ]
      },
      {
        "name": {
          "value": "Gradle Plugin",
          "evidence": "Gradle Plugin should be updated to version 2.20.1253.vc116f0763a_eb_"
        },
        "prerequisites": [
          {
            "value": "attackers able to control the build log",
            "evidence": "This allows attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.20.1253.vc116f0763a_eb_",
            "evidence": "Gradle Plugin should be updated to version 2.20.1253.vc116f0763a_eb_"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.19.1252.v15196b_5a_6e10",
            "evidence": "Gradle Plugin up to and including 2.19.1252.v15196b_5a_6e10"
          }
        ]
      },
      {
        "name": {
          "value": "Keycloak Authentication Plugin",
          "evidence": "Keycloak Authentication Plugin should be updated to version 2.4.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.4.2",
            "evidence": "Keycloak Authentication Plugin should be updated to version 2.4.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.4.1",
            "evidence": "Keycloak Authentication Plugin up to and including 2.4.1"
          }
        ]
      },
      {
        "name": {
          "value": "OWASP Dependency-Check Plugin",
          "evidence": "OWASP Dependency-Check Plugin should be updated to version 5.6.5"
        },
        "prerequisites": [
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission."
          }
        ],
        "fixed_versions": [
          {
            "value": "5.6.5",
            "evidence": "OWASP Dependency-Check Plugin should be updated to version 5.6.5"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 5.6.4",
            "evidence": "OWASP Dependency-Check Plugin up to and including 5.6.4"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Groovy Libraries Plugin",
          "evidence": "Pipeline: Groovy Libraries Plugin should be updated to version 806.v408277b_33d1d"
        },
        "prerequisites": [
          {
            "value": "attackers able to configure Pipelines",
            "evidence": "This results in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system."
          }
        ],
        "fixed_versions": [
          {
            "value": "806.v408277b_33d1d",
            "evidence": "Pipeline: Groovy Libraries Plugin should be updated to version 806.v408277b_33d1d"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 805.va_fc79344957d",
            "evidence": "Pipeline: Groovy Libraries Plugin up to and including 805.va_fc79344957d"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Multibranch Plugin",
          "evidence": "Pipeline: Multibranch Plugin should be updated to version 842.v3a_b_59b_57b_e6e"
        },
        "prerequisites": [
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to use."
          }
        ],
        "fixed_versions": [
          {
            "value": "842.v3a_b_59b_57b_e6e",
            "evidence": "Pipeline: Multibranch Plugin should be updated to version 842.v3a_b_59b_57b_e6e"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 841.vec5b_9e1806ec",
            "evidence": "Pipeline: Multibranch Plugin up to and including 841.vec5b_9e1806ec"
          }
        ]
      },
      {
        "name": {
          "value": "Robot Framework Plugin",
          "evidence": "Robot Framework Plugin should be updated to version 6.3.0"
        },
        "prerequisites": [
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution."
          }
        ],
        "fixed_versions": [
          {
            "value": "6.3.0",
            "evidence": "Robot Framework Plugin should be updated to version 6.3.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 6.2.2",
            "evidence": "Robot Framework Plugin up to and including 6.2.2"
          }
        ]
      },
      {
        "name": {
          "value": "Script Security Plugin",
          "evidence": "Script Security Plugin should be updated to version 1422.v06869826dd9b_"
        },
        "prerequisites": [
          {
            "value": "attackers with permission to define and run sandboxed scripts, including Pipelines",
            "evidence": "This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM."
          },
          {
            "value": "Exploitation requires an already approved JAR file to be served from an attacker-controlled server.",
            "evidence": "Exploitation requires an already approved JAR file to be served from an attacker-controlled server."
          }
        ],
        "fixed_versions": [
          {
            "value": "1422.v06869826dd9b_",
            "evidence": "Script Security Plugin should be updated to version 1422.v06869826dd9b_"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1415.v9a_f9b_3a_c253d",
            "evidence": "Script Security Plugin up to and including 1415.v9a_f9b_3a_c253d"
          }
        ]
      },
      {
        "name": {
          "value": "Warnings Plugin",
          "evidence": "Warnings Plugin should be updated to version 13.10259.v80f407cb_03a_e"
        },
        "prerequisites": [
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability."
          }
        ],
        "fixed_versions": [
          {
            "value": "13.10259.v80f407cb_03a_e",
            "evidence": "Warnings Plugin should be updated to version 13.10259.v80f407cb_03a_e"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 13.10258.va_17d49a_78c3b_",
            "evidence": "Warnings Plugin up to and including 13.10258.va_17d49a_78c3b_"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-92122",
        "evidence": "SECURITY-3929 / CVE-2026-92122"
      },
      {
        "value": "CVE-2026-92123",
        "evidence": "SECURITY-3931 / CVE-2026-92123"
      },
      {
        "value": "CVE-2026-92124",
        "evidence": "SECURITY-3923 / CVE-2026-92124"
      },
      {
        "value": "CVE-2026-92125",
        "evidence": "SECURITY-3925 (1) / CVE-2026-92125"
      },
      {
        "value": "CVE-2026-92126",
        "evidence": "SECURITY-3925 (2) / CVE-2026-92126"
      },
      {
        "value": "CVE-2026-92127",
        "evidence": "SECURITY-3897 / CVE-2026-92127"
      },
      {
        "value": "CVE-2026-92128",
        "evidence": "SECURITY-3932 / CVE-2026-92128"
      },
      {
        "value": "CVE-2026-92129",
        "evidence": "SECURITY-3977 / CVE-2026-92129"
      },
      {
        "value": "CVE-2026-92130",
        "evidence": "SECURITY-3729 / CVE-2026-92130"
      },
      {
        "value": "CVE-2026-92131",
        "evidence": "SECURITY-3796 / CVE-2026-92131"
      },
      {
        "value": "CVE-2026-92132",
        "evidence": "SECURITY-4028 / CVE-2026-92132"
      },
      {
        "value": "CVE-2026-92133",
        "evidence": "SECURITY-3851 / CVE-2026-92133"
      },
      {
        "value": "CVE-2026-92134",
        "evidence": "SECURITY-3937 / CVE-2026-92134"
      },
      {
        "value": "CVE-2026-92135",
        "evidence": "SECURITY-4118 / CVE-2026-92135"
      },
      {
        "value": "CVE-2026-92136",
        "evidence": "SECURITY-3992 / CVE-2026-92136"
      },
      {
        "value": "CVE-2026-92137",
        "evidence": "SECURITY-3971 / CVE-2026-92137"
      },
      {
        "value": "CVE-2026-92138",
        "evidence": "SECURITY-3778 / CVE-2026-92138"
      },
      {
        "value": "CVE-2026-92139",
        "evidence": "SECURITY-3980 / CVE-2026-92139"
      },
      {
        "value": "CVE-2026-92140",
        "evidence": "SECURITY-4027 / CVE-2026-92140"
      },
      {
        "value": "CVE-2026-92141",
        "evidence": "SECURITY-3767 / CVE-2026-92141"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23893,
  "published_at": "2026-09-16T12:00:00+00:00"
}