Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theft
Jenkins patched 20 vulnerabilities across 13 plugins, including Groovy sandbox bypasses enabling remote code execution on CI/CD controllers.
Jenkins released security updates on September 16, 2026 for 20 vulnerabilities across 13 plugins, including nine fixes in the Script Security Plugin for Groovy sandbox bypasses. CVE-2026-92127 (classpath abuse) and CVE-2026-92128 (TOCTOU race on remote JAR loading) could allow arbitrary code execution in the controller JVM, exposing build secrets, credentials, and downstream deployment environments. Other flaws include stored XSS in the Warnings, Coverage, OWASP Dependency-Check and Gitee plugins, SSRF in the Gradle and Bitbucket plugins enabling credential capture, credential exposure via CVE-2026-92130, arbitrary file write via CVE-2026-92137, OAuth token theft, and an open redirect in the Keycloak Authentication Plugin. No exploitation is reported; fixes include Script Security Plugin 1422.v06869826dd9b_.
- Nine Script Security Plugin fixes address Groovy sandbox bypasses via interface coercion, null receivers, and collection casts.
- CVE-2026-92137 (Robot Framework) allows arbitrary file writes on Jenkins controllers, potentially leading to RCE.
- Four stored XSS flaws affect Warnings, Coverage, OWASP Dependency-Check, and Gitee plugins.
- SSRF flaws in Gradle and Bitbucket plugins can capture Develocity and Bitbucket credentials.
- Upgrading plugins is recommended over relying solely on CSP mitigations in Jenkins 2.539+.
- CVEs
- CVE-2026-92122CVE-2026-92123CVE-2026-92124CVE-2026-92125CVE-2026-92126CVE-2026-92127CVE-2026-92128CVE-2026-92129CVE-2026-92130CVE-2026-92131CVE-2026-92132CVE-2026-92133CVE-2026-92134CVE-2026-92135CVE-2026-92136CVE-2026-92137CVE-2026-92138CVE-2026-92139CVE-2026-92140CVE-2026-92141
- Vendors
- Jenkins
- Products
- Jenkins Script Security Plugin
- Organizations
- Jenkins
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92122 | Sandbox Bypass in Jenkins Script Security Plugin Allows Controller RCE | 8.8 group max | <1% | PoC | |
| CVE-2026-92130 | Improper Authorization in Jenkins Pipeline: Multibranch Plugin Exposes Credentials | 3.1 | — | ||
| CVE-2026-92131 | Path Traversal in Jenkins Pipeline: Groovy Libraries Plugin | 4.2 | — | ||
| CVE-2026-92132 | Develocity Access Key Disclosure via Build Log URL in Jenkins Gradle Plugin | 5.4 | — | ||
| CVE-2026-92133 | Credential Cache Key Flaw in Jenkins GitLab Plugin Leaks GitLab API Tokens Across Folders | 5.4 | — | ||
| CVE-2026-92134 | Stored XSS in Jenkins Warnings Plugin via javascript: analysis results ID | 8.0 | — | ||
| CVE-2026-92135 | Stored XSS in Jenkins Coverage Plugin via javascript: Coverage Results ID | 8.0 | — | ||
| CVE-2026-92136 | Stored XSS in Jenkins OWASP Dependency-Check Plugin via unescaped CWE values | 8.0 | — | ||
| CVE-2026-92137 | Path Traversal in Jenkins Robot Framework Plugin Enables Controller RCE | 8.8 | — | ||
| CVE-2026-92138 | OAuth flow hijacking in Jenkins Bitbucket Server Integration Plugin | 4.2 | — | ||
| CVE-2026-92139 | SSRF Credential Capture in Jenkins Bitbucket Push and Pull Request Plugin | 6.5 | — | ||
| CVE-2026-92140 | Stored XSS in Jenkins Gitee Plugin via webhook sender name | 6.8 | — | ||
| CVE-2026-92141 | Open Redirect in Jenkins Keycloak Authentication Plugin 2.4.1 and Earlier | 4.3 | — |
From the original article
3 min read at gbhackers.com
Jenkins has released security updates addressing 20 vulnerabilities across 13 plugins, including multiple high-severity flaws that could allow authorized attackers to bypass Groovy sandbox protections and execute arbitrary code on Jenkins controllers.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.