Jenkins Security Advisory: RCE, LPE, and CSRF in script-security, git-client plugins (CVE-2026-57280-57287)

Jenkins Security Advisory 2026-06-24 Vulnerability Summary Vulnerability Overview 1. Script Security Plugin Sandbox Bypass Vulnerability - CVE: CVE-2026-57280 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin version 1402.v94c9ce464861 and earlier does not intercept implicit type conversions, allowing attackers to bypass sandbox protections and execute arbitrary code. - Remediation: Upgrade to Script Security Plugin version 1402.vc96e74964250 or later. 2. Script Security Plugin Script Security Bypass Vulnerability - CVE: CVE-2026-57281 - Severity: High - Affected Plugin: script-security - Description: Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations, allowing attackers to define and run scripts outside the sandbox. - Remediation: Upgrade to Script Security Plugin version 1402.vc96e74964250 or later. 3. Git client Plugin OS Command Injection Vulnerability - CVE: CVE-2026-57282 - Severity: Medium - Affected Plugin: git-client - Description: Git client Plugin version 6.6.0 and earlier does not properly escape workspace directory names, allowing attackers to inject shell commands. - Remediation: Upgrade to Git client Plugin version 6.6.1 or later. 4. Pipeline: Groovy Plugin CSRF Vulnerability and Unrestricted Type Instantiation - CVE: CVE-2026-57283, CVE-2026-57284 - Severity: Medium - Affected Plugin: workflow-cps - Description: Pipeline: Groovy Plugin version 4331.vd056d44658ff and earlier does not restrict instantiable types, allowing attackers to create Cross-Site Request Forgery (CSRF) vulnerabilities. - Remediation: Upgrade to Pipeline: Groovy Plugin version 4331.4333.v50a_b_076e5199 or later. 5. GitHub Branch Source Plugin Missing Permission Check - CVE: CVE-2026-57285 - Severity: Medium - Affected Plugin: github-branch-source - Description: GitHub Branch Source Plugin version 1967.1969.v205fd594c821 and earlier does not perform permission checks, allowing attackers to enumerate GitHub Enterprise Server URLs. - Remediation: Upgrade to GitHub Branch Source Plugin version 1967.1970.v8d86979736546 or later. 6. Git Parameter Plugin Missing Permission Check - CVE: CVE-2026-57286 - Severity: Medium - Affected Plugin: git-parameter - Description: Git Parameter Plugin version 462.vdcf3df2ed2ca_ and earlier does not perform permission checks, allowing attackers to list SCM branch and tag names. - Remediation: Upgrade to Git Parameter Plugin version 462.463.v496a_59f698e5 or later. 7. Job Configuration History Plugin Encrypted Values Not Redirected - CVE: CVE-2026-57287 - Severity: Medium - Affected Plugin: jobConfigHistory - Description: Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier does not redirect encrypted values, allowing attackers to view encrypted keys. - Remediation: Upgrade to Job Configuration History Plugin version 1367.vc8fa_b_15101dc or later. 8. Active Directory Plugin LDAP Injection Vulnerability - CVE: CVE-2026-57288 - Severity: Low - Affected Plugin: active-directory - Description: Active Directory Plugin version 2.41.1 and earlier does not escape usernames, allowing attackers to inject LDAP wildcard characters. - Remediation: Upgrade to Active Directory Plugin version 2.41.2 or later. 9. MCP Server Plugin Missing Permission Check - CVE: CVE-2026-57300 - Severity: Medium - Affected Plugin: mcp-server - Description: MCP Server Plugin version 0.177.v629fdb_2557fe and earlier does not perform permission checks, allowing attackers to obtain Pipeline scripts. - Remediation: Upgrade to MCP Server Plugin version 0.178.vffe5a_e770f3b_ or later. 10. Bitbucket Push and Pull Request Plugin SSL/TLS Certificate Verification Disabled - CVE: CVE-2026-57289 - Severity: Medium - Affected Plugin: bitbucket-push-and-pull-request - Description: Bitbucket Push and Pull Request Plugin version 3.3.8 and earlier unconditionally disables SSL/TLS certificate verification, allowing attackers to intercept network traffic. - Remediation: Upgrade to Bitbucket Push and Pull Request Plugin version 3.3.9 or later. 11. Priority Sorter Plugin CSRF Vulnerability - CVE: CVE-2026-57290 - Severity: Medium - Affected Plugin: PrioritySorter - Description: Priority Sorter Plugin version 936.v2c01c6b_84449 and earlier does not require POST requests, allowing attackers to override global job priority configurations. - Remediation: Upgrade to Priority Sorter Plugin version 936.937.v5581d0b_2ccb_a_ or later. 12. Gitee Plugin Missing Permission Check and CSRF Vulnerability - CVE: CVE-2026-57291, CVE-2026-57292 - Severity: Medium - Affected Plugin: gitee - Description: Gitee Plugin version 1288.v18b_deb_c9069b_ and earlier does not perform permission checks, allowing attackers to connect and capture credentials. - Remediation: Upgrade to Gitee Plugin version 1292.v2559f2f3fc20 or later. 13. Gitee Plugin Enumeration of Credential IDs - CVE: CVE-2026-57293 - Severity: Medium - Affected Plugin: gitee - Description

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: RCE, LPE, and CSRF in script-security, git-client plugins (CVE-2026-57280-57287)