Loading story…
Jenkins has disclosed multiple security vulnerabilities affecting several of its plugins, including a critical authentication bypass in the SAML Plugin (CVE-2025-64131). The official security advisory lists affected plugins such as SAML, MCP Server, Extensible Choice Parameter, JDepend, Eggplant Runner, Themis, Start Windocks Containers, azure-cli, Nexus Task Runner, OpenShift Pipeline, ByteGuard Build Actions, Curseforge Publisher, and Publish to Bitbucket. Administrators are urged to review the advisory and apply the necessary updates to mitigate the risk of exploitation.
The SAML Plugin flaw allows attackers to bypass authentication controls, potentially granting unauthorized access to Jenkins instances. Other plugin vulnerabilities may also expose systems to various risks if left unpatched. Security experts recommend immediate action to update all affected plugins to their latest versions to ensure the integrity and security of Jenkins environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
An oss-security mailing list post discussed the multiple vulnerabilities in Jenkins plugins after the advisory's release, reflecting community review and dissemination of the disclosed issues. The post did not clearly introduce a distinct new vulnerability beyond the already disclosed set.
Security reporting summarized the newly disclosed Jenkins plugin vulnerabilities and specifically called out a SAML authentication bypass vulnerability, CVE-2025-64131, as part of the broader set of issues. This amplified awareness of the advisory but did not indicate a separate incident.
Jenkins published a security advisory covering multiple vulnerabilities affecting Jenkins plugins, including issues later highlighted as a SAML authentication bypass tracked as CVE-2025-64131. The advisory marked the initial public disclosure of the plugin flaw wave.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcesecurityonline.info
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jenkins published a security advisory covering multiple vulnerabilities in widely used plugins, with fixes released for affected versions. The disclosed issues span **missing permission checks**, **unsafe deserialization**, **stored cross-site scripting**, and an **open redirect**, affecting plugins including **Script Security**, **Credentials Binding**, **Matrix Authorization Strategy**, **GitHub Branch Source**, **GitHub**, **HTML Publisher**, and **Microsoft Entra ID**. The most serious issue is an **arbitrary file write** flaw that can lead to **remote code execution**, while other bugs could let attackers abuse low-privilege access such as `Overall/Read`, `Item/Configure`, or the ability to supply credentials to a job. Jenkins said the advisory includes severity ratings, attribution, and patched plugin versions, and urged administrators to update impacted plugins to the fixed releases.
Jun 29, 2026
Jenkins, a widely used open-source automation server, has released critical security updates to address multiple high-severity vulnerabilities that could expose CI/CD pipelines to significant risks. The most severe flaw, tracked as CVE-2025-67635, affects Jenkins versions 2.540 and earlier (including LTS 2.528.2 and earlier) and allows unauthenticated attackers to trigger denial-of-service (DoS) attacks via the HTTP-based command-line interface. This vulnerability arises from improper connection handling, where corrupted HTTP CLI streams are not properly closed, enabling attackers to exhaust server resources and render Jenkins instances unresponsive. Organizations relying on Jenkins are urged to upgrade to version 2.541 or LTS 2.528.3 to mitigate this risk. In addition to the DoS vulnerability, another high-severity issue, CVE-2025-67641, was identified in the Jenkins Coverage Plugin. This flaw allows attackers with "Item/Configure" permissions to exploit coverage reports for stored cross-site scripting (XSS) attacks by submitting malicious JavaScript via the REST API. If an administrator views a compromised report, the script executes, potentially leading to session hijacking. Both vulnerabilities have been addressed in the latest Jenkins security updates, and immediate patching is recommended to protect against exploitation.
Jun 29, 2026
Jenkins released security updates for multiple plugins, including **Active Directory**, **LDAP**, **AppSpider**, **Bitbucket OAuth**, **Credentials Binding**, **Email Extension**, **GitHub Integration**, **Job Import**, **Multijob**, and **Pipeline: Groovy Libraries**. The most severe issues affect the **LDAP** and **Active Directory** plugins, which could follow LDAP referrals to attacker-controlled RMI URLs and trigger deserialization on the Jenkins controller, creating a potential path to remote code execution under certain conditions. The advisory also addressed a range of additional plugin vulnerabilities, including arbitrary file read, arbitrary file write that could enable code execution, phishing through an open redirect, CSRF-triggered actions, credential ID enumeration, and SSRF-like outbound connections. Jenkins separately disclosed a **stored XSS** flaw in the `buildgraph-view` plugin that remained unresolved at publication time, leaving users without an available fix for that issue.
Jun 29, 2026