DeutschShown in its original language — a full translation is planned for a future version.
Jenkins Plugins: Mehrere Schwachstellen
view advisory published 2026-08-05
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren sowie Cross-Site-Scripting- (XSS) oder Server-Side-Request-Forgery- (SSRF) Angriffe durchzuführen.
01
describes (23)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-70448US | — | — | ||
Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files. | ||||
| CVE-2026-70447US | —OT elevated | — | ||
Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkin… | ||||
| CVE-2026-70446US | —OT elevated | — | ||
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70445US | —OT elevated | — | ||
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenk… | ||||
| CVE-2026-70444US | — | — | ||
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentia… | ||||
| CVE-2026-70443US | — | — | ||
Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have… | ||||
| CVE-2026-70442US | — | — | ||
Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permissio… | ||||
| CVE-2026-70441US | — | — | ||
Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnera… | ||||
| CVE-2026-70440US | — | — | ||
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site script… | ||||
| CVE-2026-70439US | —OT elevated | — | ||
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality. | ||||
| CVE-2026-70438US | —OT elevated | — | ||
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credential… | ||||
| CVE-2026-70437US | — | — | ||
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected we… | ||||
| CVE-2026-70436US | —OT elevated | — | ||
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing… | ||||
| CVE-2026-70435US | —OT elevated | — | ||
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-spe… | ||||
| CVE-2026-70434US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified… | ||||
| CVE-2026-70433US | —OT elevated | — | ||
Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins… | ||||
| CVE-2026-70432US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkin… | ||||
| CVE-2026-70431US | — | — | ||
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or… | ||||
| CVE-2026-70430US | — | — | ||
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing at… | ||||
| CVE-2026-70429US | medium6.5 | — | ||
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups wi… | ||||
showing 20 of 23
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:60239 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60246 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60247 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60248 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60249 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60250 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60251 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60252 vom 2026-08-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan