High WID-SEC-2026-0779 4 CVEs

Jenkins: Mehrere Schwachstellen

Published Mar 18, 2026 · Updated Apr 23, 2026 · Revision 2 · de-DE

Vendor: Jenkins Project Vendor: Red Hat Product: Enterprise Linux Product: Jenkins Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 4

High 8.8

CVE-2026-33001

Jenkins has a link following vulnerability allows arbitrary file creation

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system acce…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Mar 18, 2026
High 7.5

CVE-2026-33002

Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HT…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Mar 18, 2026
Medium 4.3

CVE-2026-33003

Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Jenkins Project Jenkins LoadNinja Plugin org.jenkins-ci.plugins:loadninja Web / CMS Maven

Mar 18, 2026
Medium 4.3

CVE-2026-33004

Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form

Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Jenkins Project Jenkins LoadNinja Plugin org.jenkins-ci.plugins:loadninja Web / CMS Maven

Mar 18, 2026

Revision history

2026-04-23 #2
Neue Updates von Red Hat aufgenommen
2026-03-18 #1
Initiale Fassung

References

Jenkins Security Advisory 2026-03-18 vom 2026-03-18
https://www.jenkins.io/security/advisory/2026-03-18/
Red Hat Security Advisory RHSA-2026:10214 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10214
Red Hat Security Advisory RHSA-2026:10213 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10213
Red Hat Security Advisory RHSA-2026:10215 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10215
Red Hat Security Advisory RHSA-2026:10201 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10201
Red Hat Security Advisory RHSA-2026:10211 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10211
Red Hat Security Advisory RHSA-2026:10199 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10199
Red Hat Security Advisory RHSA-2026:10204 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10204
Red Hat Security Advisory RHSA-2026:10209 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10209
Red Hat Security Advisory RHSA-2026:10205 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10205
Red Hat Security Advisory RHSA-2026:10206 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10206