Jenkins Security Advisory 2026-09-02
Affects Jenkins Core Affects plugin: Allure Affects plugin: Customizable Header Affects plugin: File Parameter Affects plugin: GitLab Affects plugin: Job Configuration History Affects plugin: LDAP Affects plugin: Microsoft Entra ID (previously Azure AD) Affects plugin: Parameterized Remote Trigger Affects plugin: Performance Affects plugin: Pipeline: Build Step Affects plugin: Pipeline: Groovy Libraries Affects plugin: SAML Affects plugin: Script Security Affects plugin: SonarQube Scanner Affects plugin: ThinBackup Affects plugin: TICS Affects plugin: XebiaLabs XL Deploy Affects update-center2
CSIRTS triage
- What
- Multiple unspecified vulnerabilities affecting Jenkins Core and numerous plugins.
- Who is affected
- Jenkins Core and 15+ plugins across various versions.
- Urgency
- Unknown severity and CVSS; 8 CVEs assigned but details are not provided; monitor Jenkins security advisories for patched versions.
- Action
- Check Jenkins Security Advisory 2026-09-02 for affected versions and apply recommended patches immediately upon release.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.jenkins.io/security/advisory/2026-09-02/
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Jenkins: Multiple Vulnerabilitiescert-bund
- unknownJenkins Multiple Vulnerabilitieshkcert
- mediumCVE-2026-84677: Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names…nvd
- mediumCVE-2026-84676: Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job…nvd
- highCVE-2026-84675: OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attacker…nvd
- mediumCVE-2026-84674: Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attac…nvd
- highCVE-2026-84673: Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plu…nvd
- highCVE-2026-84672: Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants …nvd
- highCVE-2026-84671: Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrar…nvd
- highCVE-2026-84670: Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that…nvd
- highCVE-2026-84669: A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers wi…nvd
- highCVE-2026-84668: Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity pro…nvd
More from Jenkins Security Advisories
- unknownJenkins Security Advisory 2026-08-052026-08-05
- unknownJenkins Security Advisory 2026-06-242026-06-24
- unknownJenkins Security Advisory 2026-06-102026-06-10
- unknownJenkins Security Advisory 2026-05-272026-05-27
- unknownJenkins Security Advisory 2026-04-292026-04-29