Jenkins Plugins: Mehrere Schwachstellen
WID-SEC-2026-1707 · first 28.05.2026 · updated 28.05.2026 · CVSS 8,8
What it is about
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art. Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- Informationen offenzulegen
- Dateien zu manipulieren
- einen Cross-Site Scripting Angriff durchzuführen
- beliebigen Programmcode auszuführen
- Sicherheitsvorkehrungen zu umgehen
Am I affected?
Affected according to the BSI:
- Jenkins Jenkins Active Directory Plugin <2.41.1
- Jenkins Jenkins AppSpider Plugin <1.0.18
- Jenkins Jenkins Bitbucket OAuth Plugin <0.18
- Jenkins Jenkins Credentials Binding Plugin <725.ve52b_2328a_fde
- Jenkins Jenkins Email Extension Plugin <1933.1935.v276319e3cc47
- Jenkins Jenkins GitHub Integration Plugin <0.7.4
- Jenkins Jenkins Job Import Plugin <143.145.v48f9a_a_6ff384
- Jenkins Jenkins LDAP Plugin <807.809.vd3a_4e5e4ec98
- Jenkins Jenkins Multijob Plugin <669.v9d96a_d9c71b_0
- Jenkins Jenkins Pipeline: Groovy Libraries Plugin <798.v5cc688825312
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Jenkins Jenkins Active Directory Plugin 2.41.1
- Jenkins Jenkins AppSpider Plugin 1.0.18
- Jenkins Jenkins Bitbucket OAuth Plugin 0.18
- Jenkins Jenkins Credentials Binding Plugin 725.ve52b_2328a_fde
- Jenkins Jenkins Email Extension Plugin 1933.1935.v276319e3cc47
- Jenkins Jenkins GitHub Integration Plugin 0.7.4
- Jenkins Jenkins Job Import Plugin 143.145.v48f9a_a_6ff384
- Jenkins Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98
- Jenkins Jenkins Multijob Plugin 669.v9d96a_d9c71b_0
- Jenkins Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
CVE: CVE-2026-48916, CVE-2026-48917, CVE-2026-48918, CVE-2026-48919, CVE-2026-48920, CVE-2026-48921, CVE-2026-48922, CVE-2026-48923, CVE-2026-48924, CVE-2026-48925, CVE-2026-48926, CVE-2026-48927, CVE-2026-9674
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.