CloudBees Security Advisory2026-09-02

Deserialization vulnerability

SECURITY-3972 / CVE-2026-84645‍

‍Severity (CVSS): High‍

‍Description:

Jenkins uses serialization and deserialization to load and save configuration and build data (using XStream). Types storing their configuration in their own files (usually config.xml or build.xml), like agents, items, or builds, are indicated as such by implementing the Java interface PersistenceRoot. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that only allows deserialization of types defined in Jenkins core or plugins, or explicitly allowed types (JEP-200).

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s basic premise is that it uses reflective access to code elements matching its naming conventions. Since 2018, Jenkins limits request routing to only types defined in Jenkins core or plugins, and can only access fields and methods that have (return) types, parameters, or annotations related to HTTP request handling.

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, serialized objects of types marked as storing their configuration in independent top-level configuration files can appear as nested field values in user-submitted config.xml documents and subsequently handle HTTP requests via Stapler. A crafted combination of such objects can result in attackers getting access to an improperly protected Script Console, resulting in remote code execution.

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 prevents objects of types marked as storing their configuration in independent top-level configuration files in Jenkins from being deserialized as nested field values in other objects.

Lack of type restriction in deserialization allows creating user objects

SECURITY-3908 / CVE-2026-84646‍

‍Severity (CVSS): Medium‍

‍Description:

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

[!NOTE]

These user objects are not actual Jenkins accounts and cannot be used to log in. They are similar to the objects Jenkins creates from SCM changelogs to associate commits with their authors.

[/]

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 declares user objects to be of a type stored in an independent top-level file in Jenkins, which, combined with the fix for SECURITY-3972, prevents them from being deserialized as nested field values in other objects.

Instantiation of any types related to configuration

SECURITY-3915 / CVE-2026-84647‍‍

Severity (CVSS): High‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s form data binding instantiates configuration objects of types specified in form submissions.

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form submissions to those compatible with the expected field type, allowing attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.

The Stapler web framework in CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 restricts the types that can be instantiated via form data binding to those compatible with the expected field type.

Stored XSS vulnerability in system log viewer

SECURITY-3967 / CVE-2026-84648‍‍

Severity (CVSS): High‍

‍Description:

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

[!TIP]

On CloudBees CI 2.541.1.35570 and newer, Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability.

[/]

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 escapes log record metadata (source, level, and timestamp) before rendering it.

Cross-origin exposure of CSRF token

SECURITY-3878 / CVE-2026-84649‍

‍Severity (CVSS): High‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler provides an HTTP endpoint serving dynamically generated JavaScript resources.

In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in CloudBees CI 2.452.1.2 through 2.568.2.37664 (both inclusive), Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), these dynamically generated JavaScript resources embed the user’s cross-site request forgery (CSRF) token (crumb) as a string literal in their response.

These resources can be loaded as a script by a page hosted on the same site as Jenkins, such as a sibling subdomain (e.g., other-service.example.org when Jenkins is at jenkins.example.org), allowing attackers to obtain a valid crumb for the targeted user’s session and perform actions on their behalf.

[!WARNING]

This vulnerability is particularly impactful when the Resource Root URL is configured on the same site as the Jenkins URL (e.g., jenkins-assets.example.org and jenkins.example.org).

[/]

The Stapler web framework in CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 no longer embeds the crumb as a string literal in dynamically generated JavaScript resources. Instead, a JavaScript expression is embedded that reads the crumb value from the page’s DOM at runtime.

[!NOTE]

Administrators unable to immediately update Jenkins should disable the Resource Root URL feature, or configure it on a different domain than Jenkins (e.g., jenkins-assets.example.com and jenkins.example.org).

[/]

Unsafe deserialization allows overwriting configuration objects

SECURITY-4032 / CVE-2026-84650‍

‍Severity (CVSS): High‍

‍Description:

In Jenkins, fields declared transient are excluded from serialization but are still read back during deserialization for backward compatibility with existing configuration files.

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 adds a way to indicate whether transient fields should participate in deserialization. Transient fields marked as not being deserializable will be ignored, preventing unintended behavior after deserialization.

Unsafe deserialization allows overwriting other agents

SECURITY-4025 / CVE-2026-84651‍

‍Severity (CVSS): Medium‍

‍Description:

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent’s name in the submitted XML document.

This allows attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration, obtaining access to its inbound agent secret and environment variables.

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 prevents agent configuration updates from overwriting a different existing agent.

Session fixation vulnerability

SECURITY-4016 / CVE-2026-84652‍

‍Severity (CVSS): High‍

‍Description:

Jenkins’s "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again.

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, resulting in a session fixation vulnerability.

This allows attackers able to serve content on the same site as Jenkins, such as a sibling subdomain (e.g., evil.example.org when Jenkins is at jenkins.example.org), to set a known session cookie in the victim’s browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

[!NOTE]

This cannot be exploited from an unrelated domain (e.g., evil.example.com targeting Jenkins at jenkins.example.org).

[/]

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 invalidates the existing session when authenticating a user via the "remember me" cookie.

Incorrect permission check in Appearance configuration page

SECURITY-3981 / CVE-2026-84653‍

‍Severity (CVSS): Medium‍

‍Description:

CloudBees CI 2.452.1.2 through 2.568.2.37664 (both inclusive), Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page added in Jenkins 2.421.

This allows attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.

[!NOTE]

The impact of this vulnerability depends on installed plugins. For example, Simple Theme Plugin allows specifying URLs for JavaScript resources served on every Jenkins page, which can result in a cross-site scripting (XSS) vulnerability.

[/]

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 ensures that each Appearance configuration option is only accessible to users with the required permission for that option.

Form submission data binding can set static fields

SECURITY-3926 / CVE-2026-84654‍

‍Severity (CVSS): Medium‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling.

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object.

This allows attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.

The Stapler web framework in CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 no longer allows form data binding to set public static fields of configuration objects.

Injection vulnerability in REST API

SECURITY-3879 / CVE-2026-84655‍

‍Severity (CVSS): Medium

‍‍Description:

CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API.

This allows attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 escapes map keys when serializing objects as JSON and Python through its REST API.

Missing permission check allows reading build parameters

SECURITY-4006 / CVE-2026-84656

‍‍Severity (CVSS): Medium‍

‍Description:

CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not perform an Item/Read permission check in an HTTP endpoint.

This allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 performs an Item/Read permission check in the affected endpoint.

Missing permission check allows canceling builds

SECURITY-4015 / CVE-2026-84657

‍‍Severity (CVSS): Medium‍

‍Description:

The build command of the Jenkins CLI can be invoked with the -s flag to wait for a triggered build to complete, canceling the build when the CLI client is interrupted.

Jenkins merges multiple requests to build the same job with the same parameters into a single queue item.

In CloudBees CI 2.568.2.37664 and earlier, Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when canceling a build this way.

This allows attackers with Item/Build permission to cancel builds started by other users by triggering a build that merges with an existing queue item, then interrupting the CLI command.

CloudBees CI 2.568.3.37907, Jenkins 2.580, LTS 2.568.3 requires Item/Cancel permission when using the build CLI command with the -s flag to wait for build completion.

Improper access control in Script Security Plugin

SECURITY-3986 / CVE-2026-84658 (script approval), CVE-2026-84659 (Groovy sandbox)

‍‍Severity (CVSS): Medium‍

‍Affected plugin: script-security‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.

Script Security Plugin 1412.v7737b_3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.

Additionally, it does not enforce a permission check in a @DataBoundSetter annotated method, allowing attackers to invoke it to disable the "Force the use of the sandbox globally in the system" setting.

Script Security Plugin 1415.v9a_f9b_3a_c253d removes the @DataBoundConstructor annotation from the constructor that loads script approval configuration as it is not intended to be invoked by users. It also adds a permission check to the @DataBoundSetter method that controls the "Force the use of the sandbox globally in the system" setting.

Missing permission check in Pipeline: Build Step Plugin allows canceling downstream builds

SECURITY-3870 / CVE-2026-84660 (build step), CVE-2026-84661 (waitForBuild step)

‍‍Severity (CVSS): Medium‍

‍Affected plugin: pipeline-build-step‍

‍Description:

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks. Plugins like Authorize Project Plugin allow changing the authentication associated with a build.

Canceling a Pipeline using the build step causes the triggered downstream build to be canceled. The same applies to the waitForBuild step when the propagateAbort parameter is set to true.

Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier does not check Item/Cancel permission on the downstream job before canceling those builds in these cases.

This causes downstream builds to be canceled even when the build’s authentication lacks Item/Cancel permission on the downstream job.

Pipeline: Build Step Plugin 601.v6d4c6d1a_9dc7 requires Item/Cancel permission on the downstream job before canceling those builds.

Improper access control in LDAP Plugin allows SSRF

SECURITY-3678 / CVE-2026-84662‍

‍Severity (CVSS): Medium‍

‍Affected plugin: ldap‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments.

LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier uses the @DataBoundConstructor annotation on a constructor that connects to a specified URL.

This allows attackers able to submit certain forms to connect to an attacker-specified URL without the required permission.

LDAP Plugin 825.v2fca_37dd5b_cb_ confirms that the user has Overall/Administer permission before connecting to a URL in the @DataBoundConstructor-annotated constructor.

CSRF vulnerability in Pipeline: Groovy Libraries Plugin

SECURITY-3815 / CVE-2026-84663‍

‍Severity (CVSS): Medium‍

‍Affected plugin: pipeline-groovy-lib‍

‍Description:

Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete shared library caches.

Pipeline: Groovy Libraries Plugin 805.va_fc79344957d requires POST requests for the affected HTTP endpoint.

Improper access control in GitLab Plugin allows SSRF

SECURITY-4097 / CVE-2026-84664‍

‍Severity (CVSS): Medium‍

‍Affected plugin: gitlab-plugin‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.

GitLab Plugin 1.9.16 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that overwrite the global GitLab connection configuration.

This allows attackers able to submit certain forms to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.

GitLab Plugin 1.9.182144.vc1c369226a_52 removes the @DataBoundConstructor annotation from the constructor for the global GitLab connection configuration as it is not intended to be invoked by users.

Stored XSS vulnerability in SonarQube Scanner Plugin

SECURITY-3989 / CVE-2026-84665‍

‍Severity (CVSS): High‍

‍Affected plugin: sonar‍

‍Description:

SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

[!TIP]

On CloudBees CI 2.541.1.35570 and newer, Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability.

[/]

SonarQube Scanner Plugin 2.19.0 limits URL schemes for the dashboard links it creates based on SonarQube scanner results to http and https.

Additionally, existing persisted dashboard URLs with disallowed URL schemes are no longer rendered.

Improper access control in Job Configuration History Plugin

SECURITY-4098 / CVE-2026-84666‍

‍Severity (CVSS): Medium‍

‍Affected plugin: jobConfigHistory‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.

Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin’s history recording configuration.

This allows attackers able to submit certain forms to redirect history storage to an attacker-specified directory and modify history recording settings.

Job Configuration History Plugin 1380.v762185b_9a_793 removes the @DataBoundConstructor annotation from the constructor for the plugin’s global configuration as it is not intended to be invoked by users.

Improper access control in ThinBackup Plugin

SECURITY-4099 / CVE-2026-84667‍

‍Severity (CVSS): High‍

‍Affected plugin: thinBackup‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.

ThinBackup Plugin 2.1.4 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin’s backup configuration.

This allows attackers able to submit certain forms to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

ThinBackup Plugin 2.1.5 removes the @DataBoundConstructor annotation from the constructor for the plugin’s global configuration as it is not intended to be invoked by users.

Improper access control in SAML Plugin

SECURITY-4065 / CVE-2026-84668‍

‍Severity (CVSS): High‍

‍Affected plugin: saml‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments.

SAML Plugin 4.618.v441a_27fa_46d2 and earlier uses the @DataBoundConstructor annotation on a constructor that writes the SAML identity provider metadata file to the Jenkins controller file system.

This allows attackers able to submit certain forms to overwrite the SAML identity provider metadata with attacker-controlled content without the required permission, allowing them to authenticate as any user.

SAML Plugin 4.623.v7875d61cd9f5 requires Overall/Administer permission in the @DataBoundConstructor annotated constructor.

Path traversal vulnerability in Allure Plugin

SECURITY-3645 / CVE-2026-84669‍

‍Severity (CVSS): High‍

‍Affected plugin: allure-jenkins-plugin‍

‍Description:

Allure Plugin 2.35.2 and earlier does not correctly validate file paths when serving Allure report results.

This allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller’s file system.

Allure Plugin 2.36.0 validates that file paths served from Allure report results are within the report directory.

Deserialization of untrusted data vulnerability in Performance Plugin

SECURITY-4026 / CVE-2026-84670‍

‍Severity (CVSS): High‍

‍Affected plugin: performance‍

‍Description:

Performance Plugin uses Java serialization to cache performance reports in the build directory.

Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller.

This allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Performance Plugin 1017.v9e9f7b_b_b_c5e7 no longer deserializes cached performance reports.

Path traversal vulnerability in File Parameter Plugin can lead to RCE

SECURITY-4093 / CVE-2026-84671

‍‍Severity (CVSS): High‍

‍Affected plugin: file-parameters‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments.

File Parameter Plugin validates parameter names when creating build parameter definitions to ensure they are safe to use as file name components.

File Parameter Plugin 425.v3fa_801681b_5e and earlier uses the @DataBoundConstructor annotation on a constructor that stores uploaded files using the parameter name as a path without this validation.

This allows attackers able to submit certain forms to write files to arbitrary locations on the Jenkins controller file system, which can lead to remote code execution.

File Parameter Plugin 433.va_0b_80359d54d applies the same parameter name validation in the @DataBoundConstructor annotated constructor.

Privilege escalation in Microsoft Entra ID (previously Azure AD) Plugin

SECURITY-3935 / CVE-2026-84672‍

‍Severity (CVSS): High‍

‍Affected plugin: azure-ad‍

‍Description:

Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group’s unique object ID (GUID) and its display name. Entra group display names are not globally unique, and unless the tenant restricts it, any tenant member can create a group with an arbitrary display name.

This allows attackers who can create an Entra group with a display name matching that of a group with a privileged Jenkins permission grant to gain those permissions, even when the grant was configured using the group’s object ID.

Microsoft Entra ID (previously Azure AD) Plugin 711.v34046f788fd7 only grants Entra group permissions using the group’s unique object ID (GUID).

[!NOTE]

Administrators who previously relied on display-name-based group grants may lose access to Jenkins after upgrading. Setting the Java system property com.microsoft.jenkins.azuread.ObjId2FullSidMap.enableDisplayNameAuthorization to true restores the previous behavior. This is insecure and should only be used as a short-term migration aid.

[/]

Improper access control in Customizable Header Plugin leads to XSS

SECURITY-4104 / CVE-2026-84673‍

‍Severity (CVSS): High‍

‍Affected plugin: customizable-header‍

‍Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.

Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin’s appearance configuration.

This allows attackers able to submit certain forms to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

Customizable Header Plugin 330.v8a_8d87511ea_1 removes the @DataBoundConstructor annotation from the constructor for the plugin’s global configuration as it is not intended to be invoked by users.

Missing permission checks in XebiaLabs XL Deploy Plugin allow enumerating credentials IDs

SECURITY-3948 / CVE-2026-84674

‍‍Severity (CVSS): Medium‍

‍Affected plugin: deployit-plugin‍

‍Description:

XebiaLabs XL Deploy Plugin 26.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in XebiaLabs XL Deploy Plugin 26.3.0 requires the appropriate permissions.

OS command injection vulnerability on agents in TICS Plugin

SECURITY-3987 / CVE-2026-84675‍

‍Severity (CVSS): Medium‍

‍Affected plugin: tics‍

‍Description:

TICS Plugin 2025.1.1 and earlier does not correctly escape build environment variable values when constructing the OS command it executes.

This allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.

TICS Plugin 2026.1.0 correctly escapes build environment variable values when constructing the OS command it executes.

Tokens stored in plain text by Parameterized Remote Trigger Plugin

SECURITY-3800 / CVE-2026-84676‍

‍Severity (CVSS): Medium‍

‍Affected plugin: Parameterized-Remote-Trigger‍

‍Description:

Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

‍

• SECURITY-3645: High
• SECURITY-3678: Medium
• SECURITY-3800: Medium
• SECURITY-3815: Medium
• SECURITY-3870: Medium
• SECURITY-3878: High
• SECURITY-3879: Medium
• SECURITY-3908: Medium
• SECURITY-3915: High
• SECURITY-3926: Medium
• SECURITY-3935: High
• SECURITY-3948: Medium
• SECURITY-3967: High
• SECURITY-3972: High
• SECURITY-3981: Medium
• SECURITY-3986: Medium
• SECURITY-3987: Medium
• SECURITY-3989: High
• SECURITY-4006: Medium
• SECURITY-4015: Medium
• SECURITY-4016: High
• SECURITY-4025: Medium
• SECURITY-4026: High
• SECURITY-4032: High
• SECURITY-4065: High
• SECURITY-4093: High
• SECURITY-4097: Medium
• SECURITY-4098: Medium
• SECURITY-4099: High
• SECURITY-4104: High

‍

• CloudBees Traditional Platforms should be upgraded to 2.568.3.37907
• CloudBees Cloud Platforms should be upgraded to 2.568.3.37907
• Allure Plugin should be updated to version 2.36.0
• Customizable Header Plugin should be updated to version 330.v8a_8d87511ea_1
• File Parameter Plugin should be updated to version 433.va_0b_80359d54d
• Job Configuration History Plugin should be updated to version 1380.v762185b_9a_793
• Microsoft Entra ID (previously Azure AD) Plugin should be updated to version 711.v34046f788fd7
• Performance Plugin should be updated to version 1017.v9e9f7b_b_b_c5e7
• SonarQube Scanner Plugin should be updated to version 2.19.0
• ThinBackup Plugin should be updated to version 2.1.5
• TICS Plugin should be updated to version 2026.1.0
• XebiaLabs XL Deploy Plugin should be updated to version 26.3.0

‍

• Alex Laboirie (@pazu); and, independently, Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz) for SECURITY-3678
• BoGeun Jang for SECURITY-3935
• Bun (@bunmamd4cb13t) for SECURITY-4026, SECURITY-4065
• Daniel Beck, CloudBees, Inc. for SECURITY-4093, SECURITY-4098, SECURITY-4099, SECURITY-4104
• Daniel Beck, CloudBees, Inc.; and, independently, hai27ii2o; and 0xOJ for SECURITY-3645
• Emilio Galle for SECURITY-4097
• Han, JunGyu for SECURITY-3989
• Jangha Kim for SECURITY-3908
• Kai Aizen, SnailSploit for SECURITY-3948
• Murat Yilmazlar of DUBALAR, and, independently, Hamza Sakhi https://www.linkedin.com/in/hamza-sakhi-20231523b/ for SECURITY-3967
• Patrick White & ByClaude.net for SECURITY-3981
• Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz) for SECURITY-3815, SECURITY-3870, SECURITY-3878, SECURITY-3972, SECURITY-4006, SECURITY-4015, SECURITY-4016, SECURITY-4025, SECURITY-4032
• Samy Medjahed (Ap4sh) & Eliott Laurie (Ethicxz), and, independently, Gia Bui (@yabeow) from Calif.io for SECURITY-3915
• Ta Duc Thien of NTCS for SECURITY-3987
• Vitaly Simonovich (https://www.vitalysim.com) for SECURITY-3926, SECURITY-3986
• dyingman1 (https://github.com/dyingman1, redpoc Offensive Security Team) for SECURITY-3800