Jenkins Plugin Security Bulletin: Sandbox Bypass, RCE, and CSRF Vulnerabilities

Jenkins Security Advisory 2026-06-24 Vulnerability Summary Vulnerability Overview This advisory lists security vulnerabilities in multiple Jenkins plugins, including sandbox bypasses, command injection, CSRF vulnerabilities, and missing permission checks. Affected Scope Script Security Plugin - Sandbox bypass vulnerability - Affected Versions: 1402.v94c9ce464861 and earlier - Severity: High - Description: Implicit type conversions were not intercepted, allowing attackers to bypass the sandbox and execute arbitrary code. - Script security bypass vulnerability - Affected Versions: 1402.v94c9ce464861 and earlier - Severity: High - Description: Groovy AST transformation annotations were not rejected, allowing attackers to execute scripts outside the sandbox. Git client Plugin - OS command injection vulnerability on agents - Affected Versions: 6.6.0 and earlier - Severity: Medium - Description: Work directory names were not properly escaped, allowing attackers to inject commands. Pipeline: Groovy Plugin - CSRF vulnerability and unrestricted instantiation of types - Affected Versions: 4331.vd056d44658ff and earlier - Severity: Medium - Description: Allows CSRF attacks and unrestricted type instantiation. GitHub Branch Source Plugin - Missing permission check allows enumerating GitHub Enterprise server URLs - Affected Versions: 1967.1969.v205fd594c821 and earlier - Severity: Medium - Description: A missing permission check allows enumeration of GitHub Enterprise server URLs. Git Parameter Plugin - Missing permission check allows listing SCM branch and tag names - Affected Versions: 462.vdcf3df2ed2ca_ and earlier - Severity: Medium - Description: A missing permission check allows listing SCM branch and tag names. Job Configuration History Plugin - Encrypted values of secrets in job and agent configurations not redacted - Affected Versions: 1356.ve360da_6c523a_ and earlier - Severity: Medium - Description: Encrypted secret values were not hidden, allowing sensitive information to be viewed. Active Directory Plugin - LDAP injection vulnerability - Affected Versions: 2.41.1 and earlier - Severity: Low - Description: Usernames were not escaped, allowing LDAP injection. MCP Server Plugin - Missing permission check allows reading Pipeline replay scripts - Affected Versions: 0.177.v629fdb_2557fe and earlier - Severity: Medium - Description: A missing permission check allows reading Pipeline replay scripts. Bitbucket Push and Pull Request Plugin - SSL/TLS certificate validation unconditionally disabled - Affected Versions: 3.3.8 and earlier - Severity: Medium - Description: SSL/TLS certificate validation is disabled unconditionally, allowing man-in-the-middle attacks. Priority Sorter Plugin - CSRF vulnerability - Affected Versions: 936.v2c01c6b_84449 and earlier - Severity: Medium - Description: Allows CSRF attacks that can override global job priority configurations. Gitee Plugin - Missing permission checks and CSRF vulnerability - Affected Versions: 1288.v18b_deb_c9069b_ and earlier - Severity: Medium - Description: Missing permission checks and CSRF protection allow credential capture. - Incorrect permission check allows enumerating credentials IDs - Affected Versions: 1288.v18b_deb_c9069b_ and earlier - Severity: Medium - Description: Incorrect permission checks allow enumeration of credential IDs. EC2 Fleet Plugin - CSRF vulnerability and missing permission checks - Affected Versions: 4.2.3.539.v8fedff2a_81c3 and earlier - Severity: Medium - Description: Missing permission checks and CSRF protection allow capture of AWS credentials. External Workspace Manager Plugin - Path traversal vulnerability - Affected Versions: 1.3.2 and earlier - Severity: High - Description: Path traversal was not prevented, allowing access to arbitrary files. Remediation Script Security Plugin - Upgrade to version 1402.vc96e74964250 or later. Git client Plugin - Upgrade to version 6.6.1 or later. Pipeline: Groovy Plugin - Upgrade to version 4331.4333.v50a_b_076c5199 or later. GitHub Branch Source Plugin - Upgrade to version 1967.1970.v8d6979736546 or later. Git Parameter Plugin - Upgrade to version 462.463.v496a_59f698e5 or later. Job Configuration History Plugin - Upgrade to version 1367.vc8fa_b_15101dc or later. Active Directory Plugin - Upgrade to version 2.41.2 or later. MCP Server Plugin - Upgrade to version 0.178.vffe5a_e770f3b_ or later. Bitbucket Push and Pull Request Plugin - Upgrade to version 3.3.9 or later. Priority Sorter Plugin - Upgrade to version 936.937.v5581d0b_2ccb_a_ or later. Gitee Plugin - Upgrade to version 1292.v2559f2f3fc2c0 or later. EC2 Fleet Plugin - Upgrade to version 4.2.3.540.va_6eedb_7b_c112 or later. External Workspace Manager Plugin - Upgrade to version 1.3.3 or later. POC Code No specific POC code or exploit code was provided in the advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Bulletin: Sandbox Bypass, RCE, and CSRF Vulnerabilities