Executive brief
The Jenkins Gradle Plugin in version 2.19.1252.v15196b_5a_6e10 and earlier can be tricked into sending sensitive build scan credentials to attacker-controlled servers. When a build log contains a link to a build scan, the plugin requests data from that URL rather than from the configured Develocity server, allowing an attacker who can control the build log to steal the Develocity access key that Jenkins uses.
Technical details
The Gradle Plugin contains an URL parsing vulnerability in which it requests build scan data from any URL detected in the build log output, regardless of the configured Develocity server URL set in global configuration. An attacker with the ability to control build log content (e.g., by injecting output into a build stage or through a malicious build step) can inject a crafted build scan URL pointing to an attacker-controlled server. When Jenkins processes the build log, it sends the configured Develocity access key to the attacker's URL, exfiltrating the credential. This vulnerability requires an attacker to have some influence over build logs, but does not require authentication beyond that capability. The fix involves validating that build scan URLs match the configured Develocity server before making requests.
Affected products
- Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier
Timeline
- 2026-09-16: disclosed