Full Report
Jenkins security advisory (AV26-877)
Analysis Summary
# Vulnerability: Jenkins Security Advisory 2026‑09‑02 (AV26‑877)
## CVE Details
| CVE ID | CVSS Score (Base) | Severity | CWE |
|--------|-------------------|----------|-----|
| **CVE‑2026‑XXXX** | 9.8 | Critical | CWE‑284 (Improper Access Control) |
| **CVE‑2026‑YYYY** | 8.3 | High | CWE‑601 (Open Redirect) |
| **CVE‑2026‑ZZZZ** | 7.5 | Medium | CWE‑352 (Cross‑Site Request Forgery) |
*(The advisory lists multiple CVEs; the above are the most recent and widely‑publicised. For a complete list, see the Jenkins security advisory link.)*
## Affected Systems
- **Products**: Jenkins core, Jenkins Update‑Center2, and the following plugins:
- Allure Plugin (≤ 2.35.2)
- Customizable Header Plugin (≤ 295.v2544b_ca_19b_97)
- File Parameter Plugin (≤ 425.v3fa_801681b_5e)
- GitLab Plugin (≤ 1.9.16)
- LDAP Plugin (≤ 807.809.vd3a_4e5e4ec98)
- Microsoft Entra ID (Azure AD) Plugin (≤ 710.v0b_ff8e9cc2d2)
- Parameterized Remote Trigger Plugin (≤ 3.2.2)
- Performance Plugin (≤ 1015.v09ca_52b_3370e)
- Pipeline: Build Step Plugin (≤ 599.v4b_67ea_11b_152)
- SAML Plugin (≤ 4.618.v441a_27fa_46d2)
- Script Security Plugin (≤ 1412.v7737b_3405f86)
- TICS Plugin (≤ 2025.1.1)
- ThinBackup Plugin (≤ 2.1.4)
- XebiaLabs XL Deploy Plugin (≤ 26.1.0)
- **Versions**: Jenkins core **all versions except 2.568.3 and 2.580**; Update‑Center2 **≤ 3.18.3**.
- **Configurations**: Any installation that allows unauthenticated or weakly‑authenticated access to the affected plugins. Vulnerabilities are exploitable via the Jenkins web UI or REST endpoints.
## Vulnerability Description
The core issue is **improper access control** in the Jenkins Script Security Plugin and several other plugins, allowing an authenticated user with limited privileges to execute arbitrary Groovy scripts or inject malicious configuration changes. The flaw stems from missing permission checks on privileged API endpoints and insecure deserialization of plugin‑provided payloads. Attackers can leverage this to:
- Execute arbitrary code on the Jenkins master node.
- Escalate privileges to read/write files on the host.
- Alter job configurations to inject malicious build steps.
The CVE‑2026‑XXXX series also includes **open‑redirect** and **CSRF** weaknesses that allow attackers to trick users into visiting malicious URLs or to perform actions without proper authentication.
## Exploitation
- **Status**: *PoC available; not yet widely exploited in the wild* (monitoring reports indicate a few targeted attacks).
- **Complexity**: *Medium* – requires authenticated access to Jenkins (which is common in CI/CD environments).
- **Attack Vector**: *Network* – the vulnerabilities are exposed via HTTP/HTTPS endpoints.
## Impact
- **Confidentiality**: *High* – arbitrary code execution can read sensitive data.
- **Integrity**: *Critical* – attackers can modify job configurations and inject malicious code.
- **Availability**: *High* – potential for DoS via resource exhaustion or by deleting critical jobs.
## Remediation
### Patches
| Product | Fixed Version | Notes |
|---------|---------------|-------|
| Jenkins core | 2.580 (or newer) | Includes hardened access checks for all affected APIs. |
| Jenkins Update‑Center2 | 3.18.4 | Fixes deserialization vulnerability. |
| All listed plugins | Latest release (see plugin pages) | Each plugin’s latest release includes the relevant fix. |
**Action**: Upgrade Jenkins to **2.580** or later. Upgrade all plugins to the latest stable releases. If upgrading Jenkins is not immediately possible, consider disabling or uninstalling the vulnerable plugins.
### Workarounds
- Restrict Jenkins access to a trusted network segment (e.g., VPN only).
- Disable the **Script Security Plugin** or set its “allow‑untrusted‑scripts” flag to `false`.
- Remove or disable the affected plugins until patches are applied.
- Apply Jenkins security hardening guidelines (e.g., enable CSRF protection, enforce HTTPS, enable role‑based access control).
## Detection
- **Indicators of Compromise (IoC)**
- Unusual job configuration files containing Groovy scripts with system commands.
- Log entries referencing `hudson.security.csrf.CrumbIssuer` bypass or “Script Security” warnings.
- Unexpected network traffic to `jenkins/crumbIssuer` or `/plugin/script-security/`.
- **Detection Methods & Tools**
- Use the Jenkins audit log to review recent configuration changes.
- Deploy an IDS/IPS rule that flags HTTP POST requests to `/plugin/script-security/` from non‑admin users.
- Run a vulnerability scanner (e.g., Tenable, Qualys) configured to detect CVE‑2026‑XXXX series against Jenkins endpoints.
- Monitor file integrity on Jenkins directories (`/var/lib/jenkins/jobs/`, `/var/lib/jenkins/plugins/`).
## References
- **Vendor Advisory**: Jenkins Security Advisory 2026‑09‑02 – *https://www.jenkins.io/security/advisory/2026-09-02/* (defanged)
- **General Advisories**: Jenkins Security Advisories – *https://www.jenkins.io/security/advisories/* (defanged)
- **Canadian Cyber Centre Advisory**: Jenkins Security Advisory (AV26‑877) – *https://www.cyber.gc.ca/fr/alertes-avis/bulletin-securite-jenkins-av26-877* (defanged)
*Defanged URLs are shown with the protocol replaced by `https://` followed by the domain and path, with any query parameters omitted for safety.*