DeutschShown in its original language — a full translation is planned for a future version.
Jenkins: Mehrere Schwachstellen
view advisory published 2026-06-10
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, sich als Benutzer auszugeben, Benutzer auf vom Angreifer kontrollierte Domänen umzuleiten, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren sowie Cross-Site-Scripting-Angriffe durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-53442US | —OT elevated | — | ||
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml… | ||||
| CVE-2026-53441US | medium5.4 | — | ||
Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be se… | ||||
| CVE-2026-53440US | — | — | ||
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after logi… | ||||
| CVE-2026-53439US | —OT elevated | — | ||
Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to en… | ||||
| CVE-2026-53438US | —OT elevated | — | ||
A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue ite… | ||||
| CVE-2026-53437US | — | — | ||
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline charact… | ||||
| CVE-2026-53436US | — | — | ||
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments… | ||||
| CVE-2026-53435US | — | Exploit | ||
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:60239 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60246 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60247 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60248 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60249 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60250 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60251 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60252 vom 2026-08-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan