Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
251 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (./ or ../), allowing attackers to perform phishing attacks.
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views".
Recommended action: Upgrade to 2.568 or 2.555.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Recommended action: Upgrade to 2.568 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Recommended action: Upgrade to 2.555 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Recommended action: Upgrade to 2.555 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
Recommended action: Upgrade to 2.551 or 2.541.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Recommended action: Upgrade to 2.551 or 2.541.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
Recommended action: Upgrade to 2.541 or 2.528.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Recommended action: Upgrade to 2.541 or 2.528.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
Recommended action: Upgrade to 2.541 or 2.528.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Recommended action: Upgrade to 2.541 or 2.528.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Recommended action: Upgrade to 2.541 or 2.528.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed). Jenkins 2.528, LTS 2.516.3 requires Overall/Read permission to list various items in authenticated user profile dropdown menus.
Recommended action: Upgrade to 2.528 or 2.516.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Jenkins 2.527 and earlier, LTS 2.516.2 and earlier, the log formatter that prepares log messages for console output (including jenkins.log and equivalent) does not restrict or transform the characters that can be inserted from user-specified content in log messages. This allows attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output. Jenkins 2.528, LTS 2.516.3 adds an indicator at the beginning of a line that was inserted as part of log message content: [CR], [LF], or [CRLF] (representing the kind of line break), followed by .
Recommended action: Upgrade to 2.528 or 2.516.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission. This allows attackers without Overall/Read permission to list agent names through its sidepanel executors widget. Jenkins 2.528, LTS 2.516.3 removes the sidepanel from the affected view.
Recommended action: Upgrade to 2.528 or 2.516.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration. This is due to an incomplete fix of SECURITY-3495/CVE-2025-27622. Jenkins 2.504, LTS 2.492.3 requires Computer/Configure permission to copy an agent containing secrets.
Recommended action: Upgrade to 2.504 or 2.492.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration. Jenkins 2.504, LTS 2.492.3 requires Computer/Extended Read permission to copy an agent.
Recommended action: Upgrade to 2.504 or 2.492.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not require POST requests for the HTTP endpoint toggling collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets), resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets. Additionally, as the API accepts any string as the identifier of the panel ID to be toggled, attacker-controlled content can be stored in the victim’s user profile in Jenkins. Jenkins 2.500, LTS 2.492.2 requires POST requests for the affected HTTP endpoint.
Recommended action: Upgrade to 2.500 or 2.492.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI. This allows attackers with View/Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted values of secrets stored in view config.xml accessed via REST API or CLI for users lacking View/Configure permission.
Recommended action: Upgrade to 2.500 or 2.492.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Various features in Jenkins redirect users to partially user-controlled URLs inside Jenkins. To prevent open redirect vulnerabilities, Jenkins limits redirections to safe URLs (neither absolute nor scheme-relative/network-path reference). In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (\) characters are considered safe. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects. Jenkins 2.500, LTS 2.492.2 considers redirects to URLs starting with backslash (\) characters to be unsafe, rejecting such redirects.
Recommended action: Upgrade to 2.500 or 2.492.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.