Skip to content
OpenAdvisories
High WID-SEC-2026-0456 2 CVEs

Jenkins: Mehrere Schwachstellen

Published Feb 18, 2026 · Updated Apr 23, 2026 · Revision 2 · de-DE

Vendor: Jenkins Project Vendor: Red Hat Product: Enterprise Linux Product: Jenkins Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um Informationen offenzulegen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 2

  • High 8.0
    CVE-2026-27099

    Jenkins has a stored XSS vulnerability in node offline cause description

    Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 4.3
    CVE-2026-27100

    Jenkins has a build information disclosure vulnerability through Run Parameter

    Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existe…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References