Jenkins
Jenkins Security Advisory 2026-09-16
2026-09-16 Sep 16, 2026 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2026-09-16/. 18 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2026-09-16/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
24 lines
Showing 1–24 of 24
Acknowledgement
BR2026-0000-014323
SECURITY-3925
unclaimed
SECURITY-3925
Credited as Albert Puig Mercadé, CloudBees, Inc.
CVE-2026-92130
BR2026-0000-014324
SECURITY-3729
unclaimed
Exposure of System-scoped credentials in Pipeline: Multibranch Plugin
Credited as Babauca
CVE-2026-92140
BR2026-0000-014325
SECURITY-4027
unclaimed
Stored XSS vulnerability in Gitee Plugin
Credited as Bun (@bunmamd4cb13t)
CVE-2026-92132
BR2026-0000-014326
SECURITY-4028
unclaimed
SSRF vulnerability in Gradle Plugin allows capturing the Develocity access key
Credited as Bun (@bunmamd4cb13t)
CVE-2026-92136
BR2026-0000-014327
SECURITY-3992
unclaimed
Stored XSS vulnerability in OWASP Dependency-Check Plugin
Credited as Han, JunGyu
CVE-2026-92137
BR2026-0000-014328
SECURITY-3971
unclaimed
Path traversal vulnerability in Robot Framework Plugin
Credited as Moath Aloufi, https://github.com/m0xath
CVE-2026-92124
BR2026-0000-014329
SECURITY-3923
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Samy Medjahed (Ap4sh)
CVE-2026-92124
BR2026-0000-014330
SECURITY-3923
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Eliott Laurie (Ethicxz)
CVE-2026-92122
BR2026-0000-014331
SECURITY-3929
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Samy Medjahed (Ap4sh)
CVE-2026-92122
BR2026-0000-014332
SECURITY-3929
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Eliott Laurie (Ethicxz)
CVE-2026-92123
BR2026-0000-014333
SECURITY-3931
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Samy Medjahed (Ap4sh)
CVE-2026-92123
BR2026-0000-014334
SECURITY-3931
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Eliott Laurie (Ethicxz)
CVE-2026-92128
BR2026-0000-014335
SECURITY-3932
unclaimed
TOCTOU race condition in Script Security Plugin
Credited as Samy Medjahed (Ap4sh)
CVE-2026-92128
BR2026-0000-014336
SECURITY-3932
unclaimed
TOCTOU race condition in Script Security Plugin
Credited as Eliott Laurie (Ethicxz)
CVE-2026-92131
BR2026-0000-014337
SECURITY-3796
unclaimed
Path traversal vulnerability in Pipeline: Groovy Libraries Plugin
Credited as Samy Medjahed (Ap4sh)
CVE-2026-92131
BR2026-0000-014338
SECURITY-3796
unclaimed
Path traversal vulnerability in Pipeline: Groovy Libraries Plugin
Credited as Eliott Laurie (Ethicxz); and, independently, AnBui
Acknowledgement
BR2026-0000-014339
SECURITY-3925
unclaimed
SECURITY-3925
Credited as Samy Medjahed (Ap4sh)
Acknowledgement
BR2026-0000-014340
SECURITY-3925
unclaimed
SECURITY-3925
Credited as Eliott Laurie (Ethicxz); and, independently, Charles Vosburgh
CVE-2026-92139
BR2026-0000-014341
SECURITY-3980
unclaimed
SSRF vulnerability in Bitbucket Push and Pull Request Plugin allows capturing credentials
Credited as Sanghyeon Lee (h9e0n, https://github.com/isanghyeon)
CVE-2026-92135
BR2026-0000-014342
SECURITY-4118
unclaimed
Stored XSS vulnerability in Coverage Plugin
Credited as Ullrich Hafner (GitHub: uhafner)
CVE-2026-92141
BR2026-0000-014343
SECURITY-3767
unclaimed
Open redirect vulnerability in Keycloak Authentication Plugin
Credited as dyingman1 (https://github.com/dyingman1, redpoc Offensive Security Team)
CVE-2026-92138
BR2026-0000-014344
SECURITY-3778
unclaimed
OAuth access token hijacking via callback URL manipulation in Bitbucket Server Integration Plugin
Credited as dyingman1 (https://github.com/dyingman1, redpoc Offensive Security Team)
CVE-2026-92133
BR2026-0000-014345
SECURITY-3851
unclaimed
Cache confusion in GitLab Plugin
Credited as hai27ii2o; and, independently, Yutaka Sasaki
CVE-2026-92134
BR2026-0000-014346
SECURITY-3937
unclaimed
Stored XSS vulnerability in Warnings Plugin
Credited as vnyuh from CyStack Security