Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN828 _____________________________________________________________________ DATE : 06/08/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Jenkins (core), AWS CodeBuild Plugin, CodeSonar Plugin, External Workspace Manager Plugin, Google Chat Notification Plugin, HCL AppScan Plugin, Horreum Plugin, Ivy Report Plugin, Multijob Plugin, Parameterized Remote Trigger Plugin, Qualys Container Scanning Connector Plugin, Sauce OnDemand Plugin, SCM-Manager Plugin, Summary Display Plugin, Violation Comments to GitLab Plugin, Webhook Secret Credentials Provider Plugin, XML Job to Job DSL Plugin. ===================================================================== https://www.jenkins.io/security/advisory/2026-08-05/ _____________________________________________________________________ Jenkins Security Advisory 2026-08-05 This advisory announces vulnerabilities in the following Jenkins deliverables: Jenkins (core) AWS CodeBuild Plugin CodeSonar Plugin External Workspace Manager Plugin Google Chat Notification Plugin HCL AppScan Plugin Horreum Plugin Ivy Report Plugin Multijob Plugin Parameterized Remote Trigger Plugin Qualys Container Scanning Connector Plugin Sauce OnDemand Plugin SCM-Manager Plugin Summary Display Plugin Violation Comments to GitLab Plugin Webhook Secret Credentials Provider Plugin XML Job to Job DSL Plugin Descriptions Agent-to-controller deserialization filter bypass SECURITY-3911 / CVE-2026-70426 Severity (CVSS): Critical Description: Jenkins uses the Remoting library (typically agent.jar or remoting.jar) for communication between the controller and agents via serialized Java objects. To protect against deserialization vulnerabilities, Jenkins enforces the JEP-200 class filter during deserialization of objects received over a Remoting channel on the controller. In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation. This allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath, which could be leveraged to execute code on the Jenkins controller. This is limited to classes on the Jenkins core classpath (i.e., bundled with Jenkins or part of the Java platform) that are not on the pre-JEP-200 deserialization denylist. Dependencies bundled with plugins will not be deserialized. The Remoting library in Jenkins 2.576, LTS 2.568.2 also applies the class filter on the fallback code path. A workaround for this vulnerability is available in case updating to a fixed version is not possible. See this GitHub repository for details. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Link following vulnerability allows arbitrary file creation SECURITY-3930 / CVE-2026-70427 Severity (CVSS): High Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives. This allows attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins. This can result in code execution by, e.g., writing malicious scripts to the JENKINS_HOME/init.groovy.d/ directory (feature documentation), or deploying plugins to JENKINS_HOME/plugins/. This is due to an incomplete fix of SECURITY-3657. Jenkins 2.576, LTS 2.568.2 refuses to extract files from .tar and .tar.gz archives that contain symbolic links with effectively empty names. A workaround for this vulnerability is available in case updating to a fixed version is not possible. See this GitHub repository for details. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Path traversal vulnerability in file parameters SECURITY-3927 / CVE-2026-70428 Severity (CVSS): High Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names. This allows attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system, restricted only by file system access permissions of the user running Jenkins. This can result in code execution by, e.g., writing malicious scripts to the JENKINS_HOME/init.groovy.d/ directory (feature documentation), or deploying plugins to JENKINS_HOME/plugins/. Jenkins 2.576, LTS 2.568.2 improves the identification of file paths attempting path traversal in file parameter names, preventing writing files to arbitrary locations on the file system. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Improper handling of case sensitivity allows privilege escalation SECURITY-3924 / CVE-2026-70429 Severity (CVSS): High Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently. While the canonical ID for a case-insensitive user or group name is created by lowercasing the name, comparisons of user names and group names are done using String#equalsIgnoreCase. The latter considers some Unicode characters to be equal to other characters, while the former does not (e.g., the letter "dotless i" ı being equal to regular lowercase i). This allows attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions. This requires a security realm that allows these characters in user names or group names, and allows creation of users or groups that case-insensitively match existing users or groups. The Jenkins user database does not allow users to sign up with usernames outside of the ASCII range. Jenkins 2.576, LTS 2.568.2 compares usernames and group names using their canonical form and only considers them equal if their canonical forms are equal. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Users with Overall/Manage permission can instantiate any types related to configuration SECURITY-3916 / CVE-2026-70430 Severity (CVSS): Low Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. This allows attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators. Jenkins 2.576, LTS 2.568.2 restricts the types of objects that can be instantiated as part of the project naming strategy configuration to those related to that feature. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Arbitrary code execution vulnerability in Multijob Plugin SECURITY-3823 (1) / CVE-2026-70431 Severity (CVSS): High Affected plugin: jenkins-multijob-plugin Description: Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin. This vulnerability allows attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. Multijob Plugin 677.v7ffc23d6a_4c2 integrates with Script Security Plugin to enforce sandboxing of Groovy scripts. CSRF vulnerability in Multijob Plugin allows arbitrary code execution SECURITY-3823 (2) / CVE-2026-70432 Severity (CVSS): High Affected plugin: jenkins-multijob-plugin Description: Multijob Plugin 669.v9d96a_d9c71b_0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM. Multijob Plugin 677.v7ffc23d6a_4c2 requires POST requests for the affected form validation endpoint. Missing permission checks in HCL AppScan Plugin allow enumerating credentials IDs SECURITY-3771 / CVE-2026-70433 Severity (CVSS): Medium Affected plugin: appscan Description: HCL AppScan Plugin 1.8.3 and earlier does not perform permission checks in multiple HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. HCL AppScan Plugin 1.8.4 requires appropriate permissions in the affected HTTP endpoints. CSRF vulnerability and missing permission checks in SCM-Manager Plugin SECURITY-3888 / CVE-2026-70434 (CSRF), CVE-2026-70435 (permission check) Severity (CVSS): Medium Affected plugin: scm-manager Description: SCM-Manager Plugin 1.11.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDso btained through another method, capturing credentials stored in Jenkins. Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. SCM-Manager Plugin 1.12.1 requires POST requests and Item/Configure permission for these endpoints. Missing permission check in External Workspace Manager Plugin allows reading workspace files SECURITY-3907 / CVE-2026-70436 Severity (CVSS): Medium Affected plugin: external-workspace-manager Description: External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser. This allows attackers with Overall/Read permission to read files in workspaces they are not authorized to access. External Workspace Manager Plugin 1.4.2 performs the expected permissionc heck before providing access to externally-managed workspaces through the workspace browser. Non-constant time webhook bearer token comparison in Webhook Secret Credentials Provider Plugin SECURITY-3918 / CVE-2026-70437 Severity (CVSS): Low Affected plugin: webhook-secret-credentials-provider Description: Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer token. Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8 uses a constant-time comparison when validating the webhook bearer token. Missing permission checks in Parameterized Remote Trigger Plugin allow enumerating credentials IDs SECURITY-3768 / CVE-2026-70438 Severity (CVSS): Medium Affected plugin: Parameterized-Remote-Trigger Description: Parameterized Remote Trigger Plugin 3.2.2 and earlier does not perform permission checks in HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this. Missing permission checks in XML Job to Job DSL Plugin SECURITY-3779 / CVE-2026-70439 Severity (CVSS): Medium Affected plugin: xml-job-to-job-dsl Description: XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, and makes its functionality available to users lacking Overall/Read permission. While only jobs the user has Item/Read permission for will be accessible, it does not require Item/Extended Read permission to convert their configuration. Additionally, the plugin allows any user to invoke the conversion functionality, replacing any previously generated output in userContent. As of publication of this advisory, there is no fix. Learn why we announce this. Stored XSS vulnerability in Qualys Container Scanning Connector Plugin SECURITY-3749 / CVE-2026-70440 Severity (CVSS): High Affected plugin: qualys-cs Description: Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce this. Stored XSS vulnerability in Summary Display Plugin SECURITY-3750 / CVE-2026-70441 Severity (CVSS): High Affected plugin: summary_report Description: Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce this. Exposure of System-scoped credentials in Google Chat Notification Plugin SECURITY-3752 / CVE-2026-70442 Severity (CVSS): Medium Affected plugin: google-chat-notification Description: Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to use. As of publication of this advisory, there is no fix. Learn why we announce this. Exposure of System-scoped credentials in Horreum Plugin SECURITY-3756 / CVE-2026-70443 Severity (CVSS): Medium Affected plugin: horreum Description: Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL. As of publication of this advisory, there is no fix. Learn why we announce this. Missing permission check in Violation Comments to GitLab Plugin allows enumerating credentials IDs SECURITY-3763 / CVE-2026-70444 Severity (CVSS): Medium Affected plugin: violation-comments-to-gitlab Description: Violation Comments to GitLab Plugin 2.62.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this. Missing permission checks in Sauce OnDemand Plugin allow enumerating credentials IDs SECURITY-3770 / CVE-2026-70445 Severity (CVSS): Medium Affected plugin: sauce-ondemand Description: Sauce OnDemand Plugin 2.2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this. Missing permission checks in CodeSonar Plugin allow enumerating credentials IDs SECURITY-3772 / CVE-2026-70446 Severity (CVSS): Medium Affected plugin: codesonar Description: CodeSonar Plugin 3.6.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this. Missing permission checks in AWS CodeBuild Plugin allow enumerating credentials IDs SECURITY-3773 / CVE-2026-70447 Severity (CVSS): Medium Affected plugin: aws-codebuild Description: AWS CodeBuild Plugin 0.59 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this. XXE vulnerability in Ivy Report Plugin SECURITY-3899 / CVE-2026-70448 Severity (CVSS): High Affected plugin: ivy-report Description: Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. As of publication of this advisory, there is no fix. Learn why we announce this. Severity SECURITY-3749: High SECURITY-3750: High SECURITY-3752: Medium SECURITY-3756: Medium SECURITY-3763: Medium SECURITY-3768: Medium SECURITY-3770: Medium SECURITY-3771: Medium SECURITY-3772: Medium SECURITY-3773: Medium SECURITY-3779: Medium SECURITY-3823 (1): High SECURITY-3823 (2): High SECURITY-3888: Medium SECURITY-3899: High SECURITY-3907: Medium SECURITY-3911: Critical SECURITY-3916: Low SECURITY-3918: Low SECURITY-3924: High SECURITY-3927: High SECURITY-3930: High Affected Versions Jenkins weekly up to and including 2.575 Jenkins LTS up to and including 2.568.1 AWS CodeBuild Plugin up to and including 0.59 CodeSonar Plugin up to and including 3.6.0 External Workspace Manager Plugin up to and including 1.4.1 Google Chat Notification Plugin up to and including 166.ve6b_de280f2e8 HCL AppScan Plugin up to and including 1.8.3 Horreum Plugin up to and including 0.16.162.v33b_4a_a_b_5f828 Ivy Report Plugin up to and including 1.2 Multijob Plugin up to and including 669.v9d96a_d9c71b_0 Parameterized Remote Trigger Plugin up to and including 3.2.2 Qualys Container Scanning Connector Plugin up to and including 1.8.0.5 Sauce OnDemand Plugin up to and including 2.2.0 SCM-Manager Plugin up to and including 1.11.1 Summary Display Plugin up to and including 1.15 Violation Comments to GitLab Plugin up to and including 2.62.0 Webhook Secret Credentials Provider Plugin up to and including 16.v0cfa_f0215cf5 XML Job to Job DSL Plugin up to and including 0.1.13 Fix Jenkins weekly should be updated to version 2.576 Jenkins LTS should be updated to version 2.568.2 External Workspace Manager Plugin should be updated to version 1.4.2 HCL AppScan Plugin should be updated to version 1.8.4 Multijob Plugin should be updated to version 677.v7ffc23d6a_4c2 SCM-Manager Plugin should be updated to version 1.12.1 Webhook Secret Credentials Provider Plugin should be updated to version 32.v09c9b_522f0a_8 These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated. As of publication of this advisory, no fixes are available for the following plugins: AWS CodeBuild Plugin CodeSonar Plugin Google Chat Notification Plugin Horreum Plugin Ivy Report Plugin Parameterized Remote Trigger Plugin Qualys Container Scanning Connector Plugin Sauce OnDemand Plugin Summary Display Plugin Violation Comments to GitLab Plugin XML Job to Job DSL Plugin Learn why we announce these issues. Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: Abdullah Hamza (notre3l) for SECURITY-3911 Alexander Rozanov, Innopolis University for SECURITY-3899 Daniel Beck, CloudBees, Inc. and independently, Sanghyeon Lee (h9e0n, https://github.com/isanghyeon) for SECURITY-3823 (1) Kevin Guerroudj, CloudBees, Inc. for SECURITY-3823 (2) Mykhailo Kholiev for SECURITY-3918 Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz) for SECURITY-3924, SECURITY-3927, SECURITY-3930 Ugur Ozer, AI Risk Management for SECURITY-3907 Vitaly Simonovich (https://www.vitalysim.com) for SECURITY-3916 dyingman1 (https://github.com/dyingman1, redpoc Offensive Security Team) for SECURITY-3749, SECURITY-3750, SECURITY-3752, SECURITY-3756, SECURITY-3763, SECURITY-3768, SECURITY-3771, SECURITY-3772, SECURITY-3773, SECURITY-3779 dyingman1 (https://github.com/dyingman1, redpoc Offensive Security Team), and independently, Kai Aizen, SnailSploit for SECURITY-3770 khoadb175 for SECURITY-3888 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================