Jenkins Security Advisory 2026-09-02
Jenkins releases a security advisory affecting Jenkins Core, update-center2, and 17 plugins including GitLab, SAML, LDAP, Microsoft Entra ID, and Script Security.
Jenkins published its September 2, 2026 security advisory covering Jenkins Core, the update-center2 tool, and 17 plugins, including widely deployed ones such as GitLab, SAML, LDAP, Microsoft Entra ID, Script Security, SonarQube Scanner, and Pipeline: Groovy Libraries. The announcement text does not include CVE identifiers, affected version ranges, or any statement about active exploitation. Jenkins plugin advisories typically bundle fixes for issues like stored XSS, CSRF, and missing permission checks. Administrators running any of the listed components should update them via the Jenkins update center.
- Advisory spans Jenkins Core, update-center2, and 17 plugins.
- Affected plugins include GitLab, SAML, LDAP, and Microsoft Entra ID.
- No CVE identifiers or exploitation details appear in the announcement text.
- Administrators should update affected components through the Jenkins update center.
From the original article
Affects Jenkins Core Affects plugin: Allure Affects plugin: Customizable Header Affects plugin: File Parameter Affects plugin: GitLab Affects plugin: Job Configuration History Affects plugin: LDAP Affects plugin: Microsoft Entra ID (previously Azure AD) Affects plugin: Parameterized Remote Trigger Affects plugin: Performance Affects plugin: Pipeline: Build Step Affects plugin: Pipeline: Groovy Libraries Affects…
jenkins.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.