# Jenkins vulnerabilities Source: https://junglewise.ai/threats/vendors/jenkins Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/jenkins.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 116 vulnerabilities in Jenkins: 0 in the last 7 days and 57 in the last 90 days, 8 of them critical and 6 exploited in the wild. The most recent, CVE-2026-117626, was published on 28 October 2026. 14 vulnerabilities in the last four weeks, down 7% on the four before (15). 7 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 14 - Last 90 days: 57 - All time: 116 (8 critical, 6 exploited in the wild) ## About Jenkins An open-source automation and continuous integration/continuous delivery platform. ## Latest Jenkins vulnerabilities - [CVE-2026-117626: Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly) (info, published 28 Oct 2026) - [CVE-2026-117625: Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2) (info, published 28 Oct 2026) - [CVE-2026-117624: Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not) (info, published 28 Oct 2026) - [CVE-2026-117623: Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not) (info, published 28 Oct 2026) - [CVE-2026-117622: Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents) (info, published 28 Oct 2026) - [CVE-2026-117621: Jenkins workspace browser XSS in agent URL computation](https://junglewise.ai/threats/cve-2026-117621-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-computes-on) (info, published 28 Oct 2026) - [CVE-2026-117620: Jenkins Manage Old Data injection allows password override](https://junglewise.ai/threats/cve-2026-117620-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows) (info, published 28 Oct 2026) - [CVE-2026-117619: Jenkins "remember me" cookie obtained via API token authentication](https://junglewise.ai/threats/cve-2026-117619-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows) (info, published 28 Oct 2026) - [CVE-2026-117617: Jenkins symbolic link in artifact extraction path traversal](https://junglewise.ai/threats/cve-2026-117617-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-checks-for) (info, published 28 Oct 2026) - [CVE-2026-117616: Jenkins path traversal in agent name loading](https://junglewise.ai/threats/cve-2026-117616-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-provides-an) (info, published 28 Oct 2026) - [CVE-2026-117615: Jenkins arbitrary file read via symlink following during item rename](https://junglewise.ai/threats/cve-2026-117615-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-follows) (info, published 28 Oct 2026) - [CVE-2026-117614: Jenkins agent launch command approval bypass](https://junglewise.ai/threats/cve-2026-117614-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-converts-the) (info, published 28 Oct 2026) - [CVE-2026-117613: Jenkins collection element type validation bypass](https://junglewise.ai/threats/cve-2026-117613-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not) (info, published 28 Oct 2026) - [CVE-2026-117612: Jenkins XStream deserialization filter bypass via resolves-to attribute](https://junglewise.ai/threats/cve-2026-117612-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not-apply) (info, published 28 Oct 2026) - [CVE-2026-92141: Jenkins Keycloak Authentication Plugin open redirect after login](https://junglewise.ai/threats/cve-2026-92141-jenkins-keycloak-authentication-plugin-open-redirect-after-login) (medium, CVSS 4.3, published 16 Sep 2026) - [CVE-2026-92138: Jenkins Bitbucket Server Integration Plugin OAuth hijacking](https://junglewise.ai/threats/cve-2026-92138-jenkins-bitbucket-server-integration-plugin-oauth-hijacking) (medium, CVSS 4.2, published 16 Sep 2026) - [CVE-2026-92137: Jenkins Robot Framework Plugin path traversal in archive directory](https://junglewise.ai/threats/cve-2026-92137-jenkins-robot-framework-plugin-path-traversal-in-archive) (high, CVSS 8.8, published 16 Sep 2026) - [CVE-2026-92135: Jenkins Coverage Plugin stored XSS via coverage results ID validation bypass](https://junglewise.ai/threats/cve-2026-92135-jenkins-coverage-plugin-stored-xss-via-coverage-results-id) (high, CVSS 8, published 16 Sep 2026) - [CVE-2026-92134: Jenkins Warnings Plugin stored XSS via analysis results ID](https://junglewise.ai/threats/cve-2026-92134-jenkins-warnings-plugin-stored-xss-via-analysis-results-id) (high, CVSS 8, published 16 Sep 2026) - [CVE-2026-92131: Jenkins Pipeline: Groovy Libraries Plugin path traversal](https://junglewise.ai/threats/cve-2026-92131-jenkins-pipeline-groovy-libraries-plugin-path-traversal) (medium, CVSS 4.2, published 16 Sep 2026) - [CVE-2026-92130: Jenkins Pipeline: Multibranch Plugin credentials context bypass](https://junglewise.ai/threats/cve-2026-92130-jenkins-pipeline-multibranch-plugin-credentials-context-bypass) (low, CVSS 3.1, published 16 Sep 2026) - [CVE-2026-92129: Jenkins Script Security Plugin sandbox bypass with dynamic methods](https://junglewise.ai/threats/cve-2026-92129-jenkins-script-security-plugin-sandbox-bypass-with-dynamic) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-92128: Jenkins Script Security Plugin arbitrary JAR loading via double download](https://junglewise.ai/threats/cve-2026-92128-jenkins-script-security-plugin-arbitrary-jar-loading-via-double) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-92127: Jenkins Script Security Plugin classpath approval bypass](https://junglewise.ai/threats/cve-2026-92127-jenkins-script-security-plugin-classpath-approval-bypass) (high, CVSS 8, published 16 Sep 2026) - [CVE-2026-92126: Jenkins Script Security Plugin sandbox bypass via @Builder annotation](https://junglewise.ai/threats/cve-2026-92126-jenkins-script-security-plugin-sandbox-bypass-via-builder) (high, CVSS 8.5, published 16 Sep 2026) ## Most severe Jenkins vulnerabilities - [CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE](https://junglewise.ai/threats/cve-2024-23897-jenkins-command-line-interface-cli-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 24 Jan 2024) - [CVE-2019-1003030: Sandbox bypass in Jenkins Pipeline: Groovy Plugin](https://junglewise.ai/threats/cve-2019-1003030-jenkins-matrix-project-plugin-remote-code-execution) (critical, exploited in the wild, CVSS 3.1, published 13 May 2022) - [CVE-2019-1003029: Sandbox bypass in Script Security Plugin](https://junglewise.ai/threats/cve-2019-1003029-jenkins-script-security-plugin-sandbox-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 13 May 2022) - [CVE-2015-5317: Jenkins discloses project names via fingerprints](https://junglewise.ai/threats/cve-2015-5317-jenkins-user-interface-ui-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 13 May 2022) - [CVE-2017-1000353: Deserialization of Untrusted Data in Jenkins](https://junglewise.ai/threats/cve-2017-1000353-jenkins-remote-code-execution-via-cli-java-deserialization) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2018-1000861: Deserialization of Untrusted Data in Jenkins](https://junglewise.ai/threats/cve-2018-1000861-jenkins-stapler-web-framework-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP query](https://junglewise.ai/threats/cve-2016-9299-jenkins-remoting-module-java-deserialization-rce-via-ldap-query) (critical, CVSS 9.8, published 12 Jan 2017) - [CVE-2026-42523: Jenkins GitHub Plugin stored XSS in job URL validation](https://junglewise.ai/threats/cve-2026-42523-jenkins-github-plugin-stored-xss-in-job-url-validation) (critical, CVSS 9, published 29 Apr 2026) - [CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processing](https://junglewise.ai/threats/cve-2026-53435-jenkins-arbitrary-type-deserialization-in-config-xml-processing) (high, CVSS 8.8, published 10 Jun 2026) - [CVE-2026-92137: Jenkins Robot Framework Plugin path traversal in archive directory](https://junglewise.ai/threats/cve-2026-92137-jenkins-robot-framework-plugin-path-traversal-in-archive) (high, CVSS 8.8, published 16 Sep 2026) ## Vulnerabilities per week 14 vulnerabilities in the last four weeks, down 7% on the four before (15). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 28 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 15 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 14 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Jenkins technologies - [Jenkins](https://junglewise.ai/threats/technologies/jenkins): 42 vulnerabilities - [Jenkins Script Security](https://junglewise.ai/threats/technologies/script-security): 11 vulnerabilities - [Jenkins Script Security Plugin](https://junglewise.ai/threats/technologies/script-security-plugin): 11 vulnerabilities - [Jenkins Mcp Server](https://junglewise.ai/threats/technologies/mcp-server): 4 vulnerabilities - [Jenkins LTS](https://junglewise.ai/threats/technologies/jenkins-lts): 3 vulnerabilities - [Jenkins Pipeline: Groovy Libraries Plugin](https://junglewise.ai/threats/technologies/pipeline-groovy-libraries-plugin): 3 vulnerabilities - [Jenkins Publish To Bitbucket](https://junglewise.ai/threats/technologies/publish-to-bitbucket): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jenkins vulnerabilities", https://junglewise.ai/threats/vendors/jenkins, 9 November 2026.