CVE-2026-92132

The Jenkins Gradle Plugin parses the build log for a build scan link and then connects to that link to retrieve build scan data, even when a Develocity server URL is explicitly configured in the global configuration. An attacker who can influence the build log (for example, a developer or CI job that can emit a crafted scan link) can point Jenkins at an attacker-controlled URL, causing the plugin to send the Develocity access key stored in the global configuration to that host. The attacker gains the access key, which can be used to authenticate to the organization's Develocity server and access its build scan data. Any Jenkins controller running the Gradle Plugin version 2.19.1252.v15196b_5a_6e10 or earlier with a Develocity access key configured globally is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and a patch addressing the issue is available.

What to do: Update the Jenkins Gradle Plugin to a release newer than 2.19.1252.v15196b_5a_6e10 via the plugin manager. Rotate any Develocity access key stored in the Jenkins global configuration if builds may have printed untrusted scan links, restrict which users/jobs can control build log output, and audit outbound requests or Develocity logs for connections to unexpected hosts.