Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN904 _____________________________________________________________________ DATE : 17/09/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Bitbucket Push and Pull Request Plugin, Bitbucket Server Integration Plugin, Coverage Plugin, Gitee Plugin, GitLab Plugin, Gradle Plugin, Keycloak Authentication Plugin, OWASP Dependency-Check Plugin, Pipeline: Groovy Libraries Plugin, Pipeline: Multibranch Plugin, Robot Framework Plugin, Script Security Plugin, Warnings Plugin. ===================================================================== https://www.jenkins.io/security/advisory/2026-09-16/ _____________________________________________________________________ Jenkins Security Advisory 2026-09-16 This advisory announces vulnerabilities in the following Jenkins deliverables: Bitbucket Push and Pull Request Plugin Bitbucket Server Integration Plugin Coverage Plugin Gitee Plugin GitLab Plugin Gradle Plugin Keycloak Authentication Plugin OWASP Dependency-Check Plugin Pipeline: Groovy Libraries Plugin Pipeline: Multibranch Plugin Robot Framework Plugin Script Security Plugin Warnings Plugin Descriptions Sandbox bypass vulnerability in Script Security Plugin SECURITY-3929 / CVE-2026-92122 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy coerces a value to an interface by creating a proxy that forwards each interface method call to a method of the same name on that value. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method that the proxy calls when the value inherits a method of the same name as an interface method. This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1422.v06869826dd9b_ rejects the coercion of a value to an interface when the value inherits a method of the same name as an interface method. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Sandbox bypass vulnerability in Script Security Plugin SECURITY-3931 / CVE-2026-92123 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses). This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1422.v06869826dd9b_ intercepts operations performed on a null receiver. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Sandbox bypass vulnerability in Script Security Plugin SECURITY-3923 / CVE-2026-92124 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy casts a collection to another type using the elements of that collection, either passing them to a constructor of that type or casting each of them. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from the collection, but performs the cast on the collection itself rather than on the elements it checked. This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to have the cast performed on different elements by overriding the methods of a collection, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1422.v06869826dd9b_ performs the cast on the same elements it checked, rather than on the collection itself. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Sandbox bypass vulnerability in Script Security Plugin SECURITY-3925 (1) / CVE-2026-92125 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, which a script can use to link an annotation type it declares to an arbitrary AST transformation, causing Groovy to run that transformation at compile time, before the sandbox is applied. This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1422.v06869826dd9b_ rejects the @GroovyASTTransformationClass annotation during sandbox ompilation, before Groovy can resolve or execute th referenced script. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Sandbox bypass vulnerability in Script Security Plugin SECURITY-3925 (2) / CVE-2026-92126 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy’s @Builder annotation generates builder code at compile time using the strategy class named by its builderStrategy member, which can be one of the strategies provided by Groovy or a custom implementation. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, which causes Groovy to instantiate that class at compile time, before the sandbox is applied. This may allow attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox, in the rare case that a suitable class is present on the classpath of the component that evaluates the script. Script Security Plugin 1422.v06869826dd9b_ rejects @Builder annotations whose builderStrategy member names a class other than the builder strategies provided by Groovy during sandbox compilation, before Groovy can instantiate it. Sandboxed scripts can no longer refer to one of the builder strategies provided by Groovy through a star import but can still refer to it by fully qualified name or through a single-class import. Classpath approval bypass vulnerability in Script Security Plugin SECURITY-3897 / CVE-2026-92127 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin allows Groovy scripts to load classpath entries from JAR files, which administrators must approve before any script is allowed to use them. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1422.v06869826dd9b_ no longer automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item or updates that configuration through the REST API or CLI. TOCTOU race condition in Script Security Plugin SECURITY-3932 / CVE-2026-92128 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin allows Groovy scripts to load classpath entries from JAR files, specified either by file path or by URL, which administrators must approve before any script is allowed to use them. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice when a script is evaluated, confirming the approval of the first download and loading the classpath entries from the second. This results in a time-of-check to time-of-use (TOCTOU) race condition that allows attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM. Exploitation requires an already approved JAR file to be served from an attacker-controlled server. Script Security Plugin 1422.v06869826dd9b_ downloads a JAR file specified by URL only once when a script is evaluated, confirming the approval of that download and loading the classpath entries from it. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Sandbox bypass vulnerability in Script Security Plugin SECURITY-3977 / CVE-2026-92129 Severity (CVSS): High Affected plugin: script-security Description: Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy allows an existing class to be extended at runtime with additional methods. Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls to such methods from sandboxed scripts. This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox. Exploitation requires that the dynamically added methods have already been defined by code running outside the sandbox, e.g. by a plugin, as sandboxed scripts cannot extend a class themselves. Script Security Plugin 1422.v06869826dd9b_ rejects calls from sandboxed scripts to methods added dynamically to classes at runtime. Exposure of System-scoped credentials in Pipeline: Multibranch Plugin SECURITY-3729 / CVE-2026-92130 Severity (CVSS): Low Affected plugin: workflow-multibranch Description: Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to accessa nd capture credentials they are not entitled to use. Pipeline: Multibranch Plugin 842.v3a_b_59b_57b_e6e defines the appropriate context for credentials lookup in the resolveScm Pipeline step. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Path traversal vulnerability in Pipeline: Groovy Libraries Plugin SECURITY-3796 / CVE-2026-92131 Severity (CVSS): Medium Affected plugin: pipeline-groovy-lib Description: Pipeline: Groovy Libraries Plugin provides the library step to retrieve a shared library from an SCM, using a library path to specify the directory containing the library inside the SCM checkout. Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict that library path to a relative path inside the SCM checkout. Additionally, it follows symbolic links to locations outside of the SCM checkout when retrieving the library. This results in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system. Pipeline: Groovy Libraries Plugin 806.v408277b_33d1d restricts the library path to a relative path inside the SCM checkout. Additionally, it prohibits symbolic links in the library path and inside the library. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. SSRF vulnerability in Gradle Plugin allows capturing the Develocity access key SECURITY-4028 / CVE-2026-92132 Severity (CVSS): Medium Affected plugin: gradle Description: Gradle Plugin provides global options for administrators to detect build scan links in build logs, and to show an enriched build scan summary for those build scans on the build page. In Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier, the enriched build scan summary requests data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration. This allows attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL. Gradle Plugin 2.20.1253.vc116f0763a_eb_ requests build scan data from the Develocity server URL configured in the global configuration, taking only the build scan identifier from the detected build scan link. Cache confusion in GitLab Plugin SECURITY-3851 / CVE-2026-92133 Severity (CVSS): Medium Affected plugin: gitlab-plugin Description: GitLab Plugin allows jobs to override the globally configured GitLab API token credentials with an alternative one, and caches the GitLab API client it builds for those credentials. GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier derives the cache key from the credentials ID alone, omitting the folder in which the credentials are resolved, resulting in the GitLab API token credentials being taken from the folder of the job that created the cache entry. This allows attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use. GitLab Plugin 1.2152.veec0897048b_0 derives the cache key from both the credentials ID and the folder in which the credentials are resolved, taking the GitLab API token credentials from the folder of the job making the request. Stored XSS vulnerability in Warnings Plugin SECURITY-3937 / CVE-2026-92134 Severity (CVSS): High Affected plugin: warnings-ng Description: Warnings Plugin uses analysis results IDs to create the links to analysis results on the Jenkins UI. Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability. On Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability. Warnings Plugin 13.10259.v80f407cb_03a_e validates the analysis results ID when a job configuration is loaded, ensuring no link is created with a javascript: scheme URL as identifier. Stored XSS vulnerability in Coverage Plugin SECURITY-4118 / CVE-2026-92135 Severity (CVSS): High Affected plugin: coverage Description: Coverage Plugin uses coverage results IDs to create the links to coverage results on the Jenkins UI. Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability. On Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability. Coverage Plugin 3.3361.v0626103a_67e6 validates the coverage results ID when a job configuration is loaded, ensuring no link is created with a javascript: scheme URL as identifier. Stored XSS vulnerability in OWASP Dependency-Check Plugin SECURITY-3992 / CVE-2026-92136 Severity (CVSS): High Affected plugin: dependency-check-jenkins-plugin Description: OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. On Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability. OWASP Dependency-Check Plugin 5.6.5 escapes CWE values from Dependency-Check reports. Path traversal vulnerability in Robot Framework Plugin SECURITY-3971 / CVE-2026-92137 Severity (CVSS): High Affected plugin: robot Description: Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkinscontroller. This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution. Robot Framework Plugin 6.3.0 checks that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, and uses the default archive directory instead when it is not. OAuth access token hijacking via callback URL manipulation in itbucket Server Integration Plugin SECURITY-3778 / CVE-2026-92138 Severity (CVSS): Medium Affected plugin: atlassian-bitbucket-server-integration Description: Bitbucket Server Integration Plugin implements an OAuth rovider for Bitbucket Server. The OAuth authorization endpoint in Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauth_callback URL from the submitted form rather than from the server-side stored request token. An attacker who can manipulate the form submission can cause Jenkins to redirect the authorizing user’s browser to an arbitrary URL. The redirect includes the oauth_token and oauth_verifier parameters, allowing the attacker to complete the OAuth flow and obtain an access token on behalf of the victim. Exploiting this vulnerability requires the attacker to have previously registered an OAuth consumer (requires Overall/Administer permission) and to be able to intercept and modify the victim’s form submission. Bitbucket Server Integration Plugin 6.0.2 uses the server-side stored request token to determine the callback URL. SSRF vulnerability in Bitbucket Push and Pull Request Plugin allows capturing credentials SECURITY-3980 / CVE-2026-92139 Severity (CVSS): Medium Affected plugin: bitbucket-push-and-pull-request Description: Bitbucket Push and Pull Request Plugin provides a webhook endpoint at /bitbucket-hook/ to receive webhook notifications. When acting on these notifications, Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs. This allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. Bitbucket Push and Pull Request Plugin 4.1.0 takes the Bitbucket Server endpoint it connects to, and the credentials it uses, from its own configuration rather than from the webhook payload. Stored XSS vulnerability in Gitee Plugin SECURITY-4027 / CVE-2026-92140 Severity (CVSS): High Affected plugin: gitee Description: Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Gitee Plugin webhook endpoint. Gitee Plugin 1304.v2702f1d71cde escapes the sender name from Gitee push webhook payloads in build causes. Open redirect vulnerability in Keycloak Authentication Plugin SECURITY-3767 / CVE-2026-92141 Severity (CVSS): Medium Affected plugin: keycloak Description: Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Keycloak Authentication Plugin 2.4.2 only redirects to relative (Jenkins) URLs. Severity SECURITY-3729: Low SECURITY-3767: Medium SECURITY-3778: Medium SECURITY-3796: Medium SECURITY-3851: Medium SECURITY-3897: High SECURITY-3923: High SECURITY-3925 (1): High SECURITY-3925 (2): High SECURITY-3929: High SECURITY-3931: High SECURITY-3932: High SECURITY-3937: High SECURITY-3971: High SECURITY-3977: High SECURITY-3980: Medium SECURITY-3992: High SECURITY-4027: High SECURITY-4028: Medium SECURITY-4118: High Affected Versions Bitbucket Push and Pull Request Plugin up to and including 4.0.1 Bitbucket Server Integration Plugin up to and including 6.0.1 Coverage Plugin up to and including 3.3358.v9487dde48783 Gitee Plugin up to and including 1301.v8957053c7902 GitLab Plugin up to and including 1.2149.vcfc32c82b_f7f Gradle Plugin up to and including 2.19.1252.v15196b_5a_6e10 Keycloak Authentication Plugin up to and including 2.4.1 OWASP Dependency-Check Plugin up to and including 5.6.4 Pipeline: Groovy Libraries Plugin up to and including 805.va_fc79344957d Pipeline: Multibranch Plugin up to and including 841.vec5b_9e1806ec Robot Framework Plugin up to and including 6.2.2 Script Security Plugin up to and including 1415.v9a_f9b_3a_c253d Warnings Plugin up to and including 13.10258.va_17d49a_78c3b_ Fix Bitbucket Push and Pull Request Plugin should be updated to version 4.1.0 Bitbucket Server Integration Plugin should be updated to version 6.0.2 Coverage Plugin should be updated to version 3.3361.v0626103a_67e6 Gitee Plugin should be updated to version 1304.v2702f1d71cde GitLab Plugin should be updated to version 1.2152.veec0897048b_0 Gradle Plugin should be updated to version 2.20.1253.vc116f0763a_eb_ Keycloak Authentication Plugin should be updated to version 2.4.2 OWASP Dependency-Check Plugin should be updated to version 5.6.5 Pipeline: Groovy Libraries Plugin should be updated to version 806.v408277b_33d1d Pipeline: Multibranch Plugin should be updated to version 842.v3a_b_59b_57b_e6e Robot Framework Plugin should be updated to version 6.3.0 Script Security Plugin should be updated to version 1422.v06869826dd9b_ Warnings Plugin should be updated to version 13.10259.v80f407cb_03a_e These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated. Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: Albert Puig Mercadé, CloudBees, Inc. for SECURITY-3925 (2) Babauca for SECURITY-3729 Bun (@bunmamd4cb13t) for SECURITY-4027, SECURITY-4028 Han, JunGyu for SECURITY-3992 Moath Aloufi, https://github.com/m0xath for SECURITY-3971 Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz) for SECURITY-3923, SECURITY-3929, SECURITY-3931, SECURITY-3932 Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz); and, independently, AnBui for SECURITY-3796 Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz); and, independently, Charles Vosburgh for SECURITY-3925 (1) Sanghyeon Lee (h9e0n, https://github.com/isanghyeon) for SECURITY-3980 Ullrich Hafner (GitHub: uhafner) for SECURITY-4118 dyingman1 (https://github.com/dyingman1, redpoc Offensive Security Team) for SECURITY-3767, SECURITY-3778 hai27ii2o; and, independently, Yutaka Sasaki for SECURITY-3851 vnyuh from CyStack Security for SECURITY-3937 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================