Jenkins vulnerabilities and fixes

CVEs that mention Jenkins, ranked by priority. 20 tracked.

Jenkins has 20 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-08-05. Highest priority: CVE-2026-70431 (score 43/100).

• CVE-2026-70431 HIGH 8.8 Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integra
• CVE-2026-70432 HIGH 8.8 A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier a
• CVE-2026-70429 MEDIUM 6.5 UPGRADE Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names in
• CVE-2026-70439 MEDIUM 6.5 Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers la
• CVE-2026-70448 HIGH 7.1 Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XX
• CVE-2026-70447 MEDIUM 4.3 Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read p
• CVE-2026-70437 LOW 3.7 Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time
• CVE-2026-70440 MEDIUM 5.4 Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field v
• CVE-2026-70441 MEDIUM 5.4 Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build
• CVE-2026-70433 MEDIUM 4.3 Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read pe
• CVE-2026-70436 MEDIUM 4.3 Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and ear
• CVE-2026-70438 MEDIUM 4.3 A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers w
• CVE-2026-70442 MEDIUM 4.3 Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context fo
• CVE-2026-70443 MEDIUM 4.3 Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credent
• CVE-2026-70444 MEDIUM 4.3 A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers
• CVE-2026-70445 MEDIUM 4.3 Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read
• CVE-2026-70446 MEDIUM 4.3 Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read perm
• CVE-2026-70435 MEDIUM 4.2 A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read
• CVE-2026-70430 LOW 2.7 UPGRADE Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instanti
• CVE-2026-70434 MEDIUM 4.2 A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows atta

FAQ

How do I fix Jenkins vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Jenkins being exploited right now?

None of the tracked Jenkins CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Jenkins CVE should I patch first?

CVE-2026-70431 currently ranks highest (43/100): Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integra.

← Back to latest CVEs