Is CVE-2026-92134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92134 being exploited in the wild.

How severe is CVE-2026-92134?

High severity, with a CVSS score of 8, published 16 September 2026.

Which products and versions are affected?

Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier.

Is there a fix for CVE-2026-92134?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92134 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92134?

Check whether you run Jenkins Warnings Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92134: Jenkins Warnings Plugin stored XSS via analysis results ID

CVE-2026-92134 · Severity: high · CVSS 8 · Published 2026-09-16

The Jenkins Warnings Plugin, a widely-used tool for analyzing and reporting code quality issues in CI/CD pipelines, fails to validate the analysis results ID parameter when job configurations are submitted via REST API. An attacker with permission to configure jobs can inject a malicious javascript: scheme URL that executes in the browsers of users viewing the job configuration, potentially stealing credentials or performing actions on their behalf.

Vendors: Jenkins.

Quick answers

Is CVE-2026-92134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92134 being exploited in the wild.
How severe is CVE-2026-92134?: High severity, with a CVSS score of 8, published 16 September 2026.
Which products and versions are affected?: Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier.
Is there a fix for CVE-2026-92134?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92134 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92134?: Check whether you run Jenkins Warnings Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Warnings Plugin version 13.10258.va_17d49a_78c3b_ and earlier. When a job configuration is submitted through the REST API, the plugin does not sanitize or validate the analysis results ID field, allowing an attacker with Item/Configure permission to inject a javascript: scheme URL. This payload is stored persistently and executed whenever the configuration is viewed, affecting all users who access the job. No special preconditions beyond the Item/Configure permission are required. A fix is available in newer versions of the plugin.

Affected products

Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier

Timeline

2026-09-16: disclosed

References

https://www.jenkins.io/security/advisory/2026-09-16/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.