Jenkins Plugins: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• Critical 9.0
  CVE-2026-42523

  Jenkins GitHub Plugin has an XSS vulnerability

  Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable…

  Jenkins Project Jenkins GitHub Plugin com.coravy.hudson.plugins.github:github Web / CMS Maven
  Apr 29, 2026
• High 8.0
  CVE-2026-42524

  Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

  Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins HTML Publisher Plugin org.jenkins-ci.plugins:htmlpublisher Web / CMS Maven
  Apr 29, 2026
• High 7.5
  CVE-2026-42520

  Jenkins Credentials Binding Plugin has a path traversal vulnerability

  Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can l…

  Jenkins Project Jenkins Credentials Binding Plugin org.jenkins-ci.plugins:credentials-binding Web / CMS Maven
  Apr 29, 2026
• Medium 6.5
  CVE-2026-42521

  Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors

  Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated…

  Jenkins Project Jenkins Matrix Authorization Strategy Plugin jenkins-2-openjdk-21 jenkins-2-openjdk-25 Web / CMS Wolfi Maven
  Apr 29, 2026
• Medium 4.3
  CVE-2026-42519

  Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

  A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security jenkins-2-openjdk-21 Web / CMS Wolfi Maven
  Apr 29, 2026
• Medium 4.3
  CVE-2026-42522

  Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

  A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.

  Jenkins Project Jenkins GitHub Branch Source Plugin org.jenkins-ci.plugins:github-branch-source Web / CMS Maven
  Apr 29, 2026
• Medium 4.3
  CVE-2026-42525

  Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability

  Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

  Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin org.jenkins-ci.plugins:azure-ad Web / CMS Maven
  Apr 29, 2026

Revision history

1. 2026-04-29 #1

   Initiale Fassung

References

• Jenkins Security Advisory vom 2026-04-29
  https://www.jenkins.io/security/advisory/2026-04-29/