# Jenkins Project vulnerabilities Source: https://junglewise.ai/threats/vendors/jenkins-project Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/jenkins-project.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 30 vulnerabilities in Jenkins Project: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-117618, was published on 28 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 30 (0 critical, 0 exploited in the wild) ## About Jenkins Project Open source automation server for building, testing, and deploying software. ## Latest Jenkins Project vulnerabilities - [CVE-2026-117618: Jenkins first user account creation race condition](https://junglewise.ai/threats/cve-2026-117618-in-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-the-http) (info, published 28 Oct 2026) - [CVE-2026-57307: Jenkins Zowe zDevOps Plugin missing permission check in connection endpoint](https://junglewise.ai/threats/cve-2026-57307-jenkins-zowe-zdevops-plugin-missing-permission-check-in) (medium, CVSS 4.2, published 24 Jun 2026) - [CVE-2026-57306: Jenkins Zowe zDevOps Plugin CSRF in credential connection endpoint](https://junglewise.ai/threats/cve-2026-57306-jenkins-zowe-zdevops-plugin-csrf-in-credential-connection) (medium, CVSS 4.2, published 24 Jun 2026) - [CVE-2026-57305: Jenkins Assembla Plugin CSRF in connection endpoint](https://junglewise.ai/threats/cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57304: Jenkins Assembla Plugin missing permission check in connection endpoint](https://junglewise.ai/threats/cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57303: Jenkins Assembla Plugin XXE in XML parser](https://junglewise.ai/threats/cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser) (high, CVSS 7.1, published 24 Jun 2026) - [CVE-2026-57302: Jenkins FitNesse Plugin cleartext storage of passwords in job config](https://junglewise.ai/threats/cve-2026-57302-jenkins-fitnesse-plugin-cleartext-storage-of-passwords-in-job) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57301: Jenkins OWASP ZAP Plugin arbitrary code execution on controller](https://junglewise.ai/threats/cve-2026-57301-jenkins-owasp-zap-plugin-arbitrary-code-execution-on-controller) (high, CVSS 8.8, published 24 Jun 2026) - [CVE-2026-57300: Jenkins MCP Server Plugin missing permission check in Pipeline replay scripts](https://junglewise.ai/threats/cve-2026-57300-jenkins-mcp-server-plugin-missing-permission-check-in-pipeline) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57299: Jenkins Contrast Continuous Application Security Plugin missing permission check](https://junglewise.ai/threats/cve-2026-57299-jenkins-contrast-continuous-application-security-plugin-missing) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57298: Jenkins Contrast Continuous Application Security Plugin CSRF](https://junglewise.ai/threats/cve-2026-57298-jenkins-contrast-continuous-application-security-plugin-csrf) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57297: Jenkins Contrast Continuous Application Security Plugin missing permission check](https://junglewise.ai/threats/cve-2026-57297-jenkins-contrast-continuous-application-security-plugin-missing) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57296: Jenkins External Workspace Manager Plugin path traversal in exwsAllocate](https://junglewise.ai/threats/cve-2026-57296-jenkins-external-workspace-manager-plugin-path-traversal-in) (high, CVSS 8.8, published 24 Jun 2026) - [CVE-2026-57295: Jenkins EC2 Fleet Plugin CSRF in AWS credential connection](https://junglewise.ai/threats/cve-2026-57295-jenkins-ec2-fleet-plugin-csrf-in-aws-credential-connection) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57294: Jenkins EC2 Fleet Plugin missing permission check in AWS credential handling](https://junglewise.ai/threats/cve-2026-57294-jenkins-ec2-fleet-plugin-missing-permission-check-in-aws) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57293: Jenkins Gitee Plugin incorrect permission check allows credential ID enumeration](https://junglewise.ai/threats/cve-2026-57293-jenkins-gitee-plugin-incorrect-permission-check-allows-credential) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57292: Jenkins Gitee Plugin CSRF in connection endpoint](https://junglewise.ai/threats/cve-2026-57292-jenkins-gitee-plugin-csrf-in-connection-endpoint) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57291: Jenkins Gitee Plugin missing permission check in connection endpoint](https://junglewise.ai/threats/cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57290: Jenkins Priority Sorter Plugin CSRF in global job priority configuration](https://junglewise.ai/threats/cve-2026-57290-jenkins-priority-sorter-plugin-csrf-in-global-job-priority) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57289: Jenkins Bitbucket Push and Pull Request Plugin disabled SSL validation](https://junglewise.ai/threats/cve-2026-57289-jenkins-bitbucket-push-and-pull-request-plugin-disabled-ssl) (medium, CVSS 4.8, published 24 Jun 2026) - [CVE-2026-57287: Jenkins Job Configuration History Plugin information disclosure in configuration history](https://junglewise.ai/threats/cve-2026-57287-jenkins-job-configuration-history-plugin-information-disclosure) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57286: Jenkins Git Parameter Plugin missing permission check in SCM metadata endpoint](https://junglewise.ai/threats/cve-2026-57286-jenkins-git-parameter-plugin-missing-permission-check-in-scm) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57285: Jenkins GitHub Branch Source Plugin missing permission check in API endpoint](https://junglewise.ai/threats/cve-2026-57285-jenkins-github-branch-source-plugin-missing-permission-check-in) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57284: Jenkins Pipeline Groovy Plugin unrestricted instantiation in Snippet Generator](https://junglewise.ai/threats/cve-2026-57284-jenkins-pipeline-groovy-plugin-unrestricted-instantiation-in) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-57283: Jenkins Pipeline Groovy Plugin CSRF in Snippet Generator](https://junglewise.ai/threats/cve-2026-57283-jenkins-pipeline-groovy-plugin-csrf-in-snippet-generator) (medium, CVSS 4.3, published 24 Jun 2026) ## Most severe Jenkins Project vulnerabilities - [CVE-2026-57296: Jenkins External Workspace Manager Plugin path traversal in exwsAllocate](https://junglewise.ai/threats/cve-2026-57296-jenkins-external-workspace-manager-plugin-path-traversal-in) (high, CVSS 8.8, published 24 Jun 2026) - [CVE-2026-57301: Jenkins OWASP ZAP Plugin arbitrary code execution on controller](https://junglewise.ai/threats/cve-2026-57301-jenkins-owasp-zap-plugin-arbitrary-code-execution-on-controller) (high, CVSS 8.8, published 24 Jun 2026) - [CVE-2026-48921: Jenkins Pipeline: Groovy Libraries Plugin arbitrary file read via symbolic links](https://junglewise.ai/threats/cve-2026-48921-jenkins-pipeline-groovy-libraries-plugin-arbitrary-file-read-via) (high, CVSS 7.5, published 27 May 2026) - [CVE-2026-57303: Jenkins Assembla Plugin XXE in XML parser](https://junglewise.ai/threats/cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser) (high, CVSS 7.1, published 24 Jun 2026) - [CVE-2026-48916: Jenkins LDAP Plugin Remote Code Execution via LDAP Referrals](https://junglewise.ai/threats/cve-2026-48916-jenkins-ldap-plugin-remote-code-execution-via-ldap-referrals) (medium, CVSS 6.6, published 27 May 2026) - [CVE-2026-57304: Jenkins Assembla Plugin missing permission check in connection endpoint](https://junglewise.ai/threats/cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57294: Jenkins EC2 Fleet Plugin missing permission check in AWS credential handling](https://junglewise.ai/threats/cve-2026-57294-jenkins-ec2-fleet-plugin-missing-permission-check-in-aws) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57291: Jenkins Gitee Plugin missing permission check in connection endpoint](https://junglewise.ai/threats/cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57305: Jenkins Assembla Plugin CSRF in connection endpoint](https://junglewise.ai/threats/cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint) (medium, CVSS 5.4, published 24 Jun 2026) - [CVE-2026-57295: Jenkins EC2 Fleet Plugin CSRF in AWS credential connection](https://junglewise.ai/threats/cve-2026-57295-jenkins-ec2-fleet-plugin-csrf-in-aws-credential-connection) (medium, CVSS 5.4, published 24 Jun 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Jenkins Project technologies - [Jenkins Project Assembla Plugin](https://junglewise.ai/threats/technologies/assembla-plugin): 3 vulnerabilities - [Jenkins Project Contrast Continuous Application Security Plugin](https://junglewise.ai/threats/technologies/contrast-continuous-application-security-plugin): 3 vulnerabilities - [Jenkins Project Gitee Plugin](https://junglewise.ai/threats/technologies/gitee-plugin): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jenkins Project vulnerabilities", https://junglewise.ai/threats/vendors/jenkins-project, 9 November 2026.