Jenkins Security Advisory 2026-09-16: 13 Plugins Patched, Including GitLab, Bitbucket, Gradle, and Script Security

Jenkins released a security advisory on September 16, 2026 patching vulnerabilities across 13 plugins, including Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, and Script Security.…

On September 16, 2026, Jenkins published a security advisory addressing vulnerabilities in 13 plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script Security, and Warnings. The affected plugins span SCM integrations, pipeline libraries, and authentication components. The release was announced via the oss-security mailing list as a routine coordinated disclosure without exploit details. Specific patched versions cited in the announcement include Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin (version not specified in the reports). Jenkins users should update all listed plugins to their patched versions per the advisory.

• Jenkins security advisory dated September 16, 2026 covers 13 plugins.
• Affected plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script…
• Plugins span SCM integrations, pipeline libraries, and authentication components.
• Specific patched versions per the oss-security notice: Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, and GitLab Plugin…
• A Gradle Plugin fix was also released, but no patched version number was provided in the reports.
• Disclosure was routine coordinated disclosure via the oss-security mailing list; the announcement contained no exploit details.
• Neither report provides CVE identifiers for the fixed vulnerabilities.