This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Jenkins fixes 30 vulnerabilities in plugins
Jenkins warns of 30 vulnerabilities in its plugins. The most severe of them are described below; the rest can be found at [1]. Plugins and their fixed versions (where available) [1]: Active Directory Plugin – 2.41.2 Assembla Plugin – no fix available at the time of publication Bitbucket Push and Pull Request Plugin – 3.3.9 Contrast Continuous Application Security Plugin – 3.12 EC2 Fleet Plugin – 4.2.3.540.va_6eedb_7b_c112 External Workspace Manager Plugin – 1.4.0 FitNesse Plugin – no fix available at the time of publication Git client Plugin – 6.6.1 Git Parameter Plugin – 462.463.v496a_59f698e5 Gitee Plugin – 1292.v2559f2f3f2c0 GitHub Branch Source Plugin – 1967.1970.vd86979736546 Job Configuration History Plugin – 1367.vc8fa_b_15101dc MCP Server Plugin – 0.178.vffe5a_e770f3b_ OWASP ZAP Plugin – no fix available at the time of publication Pipeline: Groovy Plugin – 4331.4333.v50a_b_076c5199 Priority Sorter Plugin – 936.937.v5581d0b_2ccb_a_ Script Security Plugin – 1402.1405.vc96e74964250 Zowe zDevOps Plugin – no fix available at the time of publication
Allows an authenticated remote attacker with low privileges to bypass sandbox protection in the Script Security plugin, due to unhandled implicit casting of collection elements in a typed for loop, call constructors of arbitrary types without checks and execute arbitrary code on the Jenkins controller [1].
The vulnerability is present in product:
- *:Script Security Plugin; <=1402.v94c9ce464861
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-57280 at cve.org, NVD
- CWE-184: Incomplete List of Disallowed Inputs at cwe.mitre.org
The vulnerability was publicly disclosed 24. 6. 2026.
Allows an authenticated remote attacker with low privileges to escape from the configured disk mount point in the External Workspace Manager plugin, due to unhandled .. segments when validating the workspace path, read arbitrary files on the Jenkins controller's file system and subsequently execute code [1].
The vulnerability is present in product:
- *:External Workspace Manager Plugin; <=1.3.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-57296 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 24. 6. 2026.
Allows an authenticated remote attacker to execute code outside the sandbox in the Script Security plugin if a suitable Groovy script is present on the classpath of the component evaluating the script [1].
The vulnerability is present in product:
- *:Script Security Plugin; <=1402.v94c9ce464861
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-57281 at cve.org, NVD
- CWE-693: Protection Mechanism Failure at cwe.mitre.org
The vulnerability was publicly disclosed 24. 6. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 25. 6. 2026.