Vendor
Jenkins vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 116 vulnerabilities in Jenkins: 0 in the last 7 days and 57 in the last 90 days, 8 of them critical and 6 exploited in the wild. The most recent, CVE-2026-117626, was published on 28 October 2026. 14 vulnerabilities in the last four weeks, down 7% on the four before (15). 7 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 57
- Critical, all time
- 8
- Exploited in the wild
- 6
About Jenkins
An open-source automation and continuous integration/continuous delivery platform.
Jenkins technologies
Latest Jenkins vulnerabilities
- CVE-2026-117626: Jenkins path traversal in file browser workspace disclosureinfo
- CVE-2026-117625: Jenkins missing HTTP proxy permission checkinfo
- CVE-2026-117624: Jenkins deserialization filter bypass in XStream resolves-to attributeinfo
- CVE-2026-117623: Jenkins stored cross-site scripting in breadcrumb menu tooltipsinfo
- CVE-2026-117622: Jenkins agent XSS via Stapler HttpResponse exceptionsinfo
- CVE-2026-117621: Jenkins workspace browser XSS in agent URL computationinfo
- CVE-2026-117620: Jenkins Manage Old Data injection allows password overrideinfo
- CVE-2026-117619: Jenkins "remember me" cookie obtained via API token authenticationinfo
- CVE-2026-117617: Jenkins symbolic link in artifact extraction path traversalinfo
- CVE-2026-117616: Jenkins path traversal in agent name loadinginfo
- CVE-2026-117615: Jenkins arbitrary file read via symlink following during item renameinfo
- CVE-2026-117614: Jenkins agent launch command approval bypassinfo
- CVE-2026-117613: Jenkins collection element type validation bypassinfo
- CVE-2026-117612: Jenkins XStream deserialization filter bypass via resolves-to attributeinfo
- CVE-2026-92141: Jenkins Keycloak Authentication Plugin open redirect after loginmediumCVSS 4.3EPSS 0.3%
- CVE-2026-92138: Jenkins Bitbucket Server Integration Plugin OAuth hijackingmediumCVSS 4.2EPSS 0.1%
- CVE-2026-92137: Jenkins Robot Framework Plugin path traversal in archive directoryhighCVSS 8.8EPSS 0.8%
- CVE-2026-92135: Jenkins Coverage Plugin stored XSS via coverage results ID validation bypasshighCVSS 8EPSS 0.4%
- CVE-2026-92134: Jenkins Warnings Plugin stored XSS via analysis results IDhighCVSS 8EPSS 0.4%
- CVE-2026-92131: Jenkins Pipeline: Groovy Libraries Plugin path traversalmediumCVSS 4.2EPSS 0.2%
- CVE-2026-92130: Jenkins Pipeline: Multibranch Plugin credentials context bypasslowCVSS 3.1EPSS 0.2%
- CVE-2026-92129: Jenkins Script Security Plugin sandbox bypass with dynamic methodshighCVSS 7.5EPSS 0.5%
- CVE-2026-92128: Jenkins Script Security Plugin arbitrary JAR loading via double downloadhighCVSS 7.5EPSS 0.3%
- CVE-2026-92127: Jenkins Script Security Plugin classpath approval bypasshighCVSS 8EPSS 0.6%
- CVE-2026-92126: Jenkins Script Security Plugin sandbox bypass via @Builder annotationhighCVSS 8.5EPSS 0.5%
Most severe Jenkins vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCEcriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2019-1003030: Sandbox bypass in Jenkins Pipeline: Groovy Plugincriticalexploited in the wildCVSS 3.1EPSS 96.9%
- CVE-2019-1003029: Sandbox bypass in Script Security Plugincriticalexploited in the wildCVSS 3.1EPSS 73.9%
- CVE-2015-5317: Jenkins discloses project names via fingerprintscriticalexploited in the wildCVSS 3.1EPSS 23.0%
- CVE-2017-1000353: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 99.7%
- CVE-2018-1000861: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 98.3%
- CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP querycriticalCVSS 9.8EPSS 96.9%
- CVE-2026-42523: Jenkins GitHub Plugin stored XSS in job URL validationcriticalCVSS 9EPSS 0.3%
- CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processinghighCVSS 8.8EPSS 2.2%
- CVE-2026-92137: Jenkins Robot Framework Plugin path traversal in archive directoryhighCVSS 8.8EPSS 0.8%
Vulnerabilities per week
14 vulnerabilities in the last four weeks, down 7% on the four before (15). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 28 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 15 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 14 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Jenkins vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/jenkins)<a href="https://junglewise.ai/threats/vendors/jenkins"><img src="https://junglewise.ai/threats/vendors/jenkins/badge.svg" alt="Jenkins vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/jenkins.json, and this page as text at https://junglewise.ai/threats/vendors/jenkins.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Jenkins vulnerabilities", https://junglewise.ai/threats/vendors/jenkins, 9 November 2026.