Jenkins Security Advisory: Multiple Plugin Vulnerabilities including RCE, XSS, and Deserialization (CVE-2026-42519 to 42525)

Jenkins Security Advisory 2026-04-29 Vulnerability Summary Vulnerability Overview This advisory covers security vulnerabilities in multiple Jenkins plugins, primarily including missing permission checks, path traversal, deserialization vulnerabilities, cross-site scripting (XSS), and open redirect issues. 1. Script Security Plugin: Enumeration of pending and approved classpath CVE: CVE-2026-42519 Severity: Medium Description: Older versions of the plugin did not perform permission checks on HTTP endpoints, allowing attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths. 2. Credentials Binding Plugin: Path traversal vulnerability CVE: CVE-2026-42520 Severity: High Description: The plugin failed to sanitize the file portion of filenames and zip file credentials. Attackers could exploit this to write credentials to arbitrary locations on the node filesystem; if configuration allows low-privileged users to configure credentials, it may lead to remote code execution. 3. Matrix Authorization Strategy Plugin: Insecure deserialization CVE: CVE-2026-42521 Severity: Medium Description: The plugin did not restrict instantiable classes when deserializing inheritance policies, allowing attackers with Item/Configure permission to instantiate arbitrary types, potentially leading to information disclosure. 4. GitHub Branch Source Plugin: Missing permission check for connection test CVE: CVE-2026-42522 Severity: Medium Description: The plugin did not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to connect to URLs specified by the attacker. 5. GitHub Plugin: XSS vulnerability CVE: CVE-2026-42523 Severity: High Description: The plugin did not properly escape the current job URL when handling the "GitHub hook trigger for GITScm polling" feature, resulting in a stored cross-site scripting (XSS) vulnerability. 6. HTML Publisher Plugin: XSS vulnerability CVE: CVE-2026-42524 Severity: High Description: The plugin did not escape job names and URLs in legacy wrapper files, leading to a stored cross-site scripting (XSS) vulnerability. Mitigation: Enforcing Content Security Policy in Jenkins 2.539 and later (LTS 2.541.1 and later) mitigates this vulnerability. 7. Microsoft Entra ID (Azure AD) Plugin: Open redirect vulnerability CVE: CVE-2026-42525 Severity: Medium Description: The plugin did not restrict redirect URLs after login, allowing attackers to redirect users to different sites via phishing attacks. Affected Versions Credentials Binding Plugin: 719.v80e905ef14eb_ and earlier GitHub Plugin: 1.46.0 and earlier GitHub Branch Source Plugin: 1967.vdea_d580c1a_b_a_ and earlier HTML Publisher Plugin: 427 and earlier Matrix Authorization Strategy Plugin: 3.2.9 and earlier Microsoft Entra ID (Azure AD) Plugin: 666.v6060de32f87d and earlier Script Security Plugin: 1399.ve6a_66547f6e1 and earlier Remediation It is recommended to update the affected plugins to the following versions: Credentials Binding Plugin: 720.v3f6dcef43ea_ GitHub Plugin: 1.46.0.1 GitHub Branch Source Plugin: 1967.1969.v205fd594c821 HTML Publisher Plugin: 427.1 Matrix Authorization Strategy Plugin: 3.2.10 Microsoft Entra ID (Azure AD) Plugin: 667.v4c5827a_e74a_0 Script Security Plugin: 1402.v94c9ce464861

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple Plugin Vulnerabilities including RCE, XSS, and Deserialization (CVE-2026-42519 to 42525)