This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Jenkins fixes 2 vulnerabilities

Jenkins versions 2.551 (weekly) and 2.541.2 (LTS) fix 2 vulnerabilities [1].

Jenkins - XSS (CVE-2026-27099)
CVSS 8.0 (High)

Allows an authenticated remote attacker with Agent/Configure or Agent/Disconnect permissions to carry out a stored XSS attack [1][2].

The vulnerability is present in products:

  • Jenkins (weekly); >=2.483, <2.551;
  • Jenkins (LTS); >=2.492.1, <2.541.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-27099 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 18. 2. 2026.

Jenkins - information disclosure (CVE-2026-27100)
CVSS 4.3 (Medium)

Allows an authenticated remote attacker with Item/Build and Item/Configure permissions to obtain, under certain conditions, unauthorized information about the existence of specific jobs and builds, or their display name [1].

The vulnerability is present in products:

  • Jenkins (weekly); <2.551;
  • Jenkins (LTS); <2.541.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 18. 2. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 23. 2. 2026.

CESNET, z.s.p.o. Logo