Loading story…
Jenkins disclosed two Jenkins Core vulnerabilities affecting Jenkins 2.550 and earlier and LTS 2.541.1 and earlier: a high-severity stored XSS issue (CVE-2026-27099 / SECURITY-3669) and a medium-severity information disclosure issue via Run Parameter handling (CVE-2026-27100 / SECURITY-3658). The XSS flaw stems from improper escaping of user-supplied HTML in the node “offline cause” description (specifically the “Mark temporarily offline” reason), enabling attackers with Agent/Configure or Agent/Disconnect permissions to inject JavaScript that can execute in other users’ sessions.
Jenkins fixed both issues in Jenkins 2.551 and LTS 2.541.2 by escaping the offline-cause description and rejecting Run Parameter values that reference builds the submitting user cannot access. For CVE-2026-27099, Jenkins noted that on Jenkins 2.539+, enforcing Content Security Policy (CSP) can mitigate the impact (with partial protection referenced for newer versions). Both vulnerabilities were reported via the Jenkins Bug Bounty Program sponsored by the European Commission, and organizations running affected versions should prioritize upgrading to the patched releases to reduce risk to CI/CD build environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Jenkins addressed the disclosed vulnerabilities by releasing Jenkins 2.551 and LTS 2.541.2. The fixes escape user-supplied offline cause description input and reject unauthorized Run Parameter values; the advisory also noted CSP on Jenkins 2.539+ offers partial protection against the XSS issue.
Jenkins published a security advisory disclosing two core vulnerabilities affecting Jenkins 2.550 and earlier and LTS 2.541.1 and earlier: a high-severity stored XSS flaw in node offline cause descriptions (CVE-2026-27099) and a medium-severity information disclosure issue in Run Parameter handling (CVE-2026-27100).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jenkins has released fixes in **Jenkins 2.568** and **Jenkins LTS 2.555.3** for multiple vulnerabilities affecting the automation server, including a high-impact unsafe deserialization flaw tracked as **`CVE-2026-53435`**. According to the disclosure, attackers with **Overall/Read** permission and additional access such as a valid user account or the ability to post `config.xml` data could trigger deserialization of Jenkins core or plugin types, potentially leading to **user impersonation, arbitrary HTTP requests, possible Script Console code execution, and arbitrary file reads** from the Jenkins controller. The issues affect **Jenkins 2.567 and earlier** and **Jenkins LTS 2.555.2 and earlier**. The advisory also addresses several additional weaknesses, including **open redirect** bugs in the login flow, a **missing permission check** in HTTP endpoints, an **unsafe redirect** in the "Delegate to servlet container" security realm, a **stored XSS** issue through offline cause descriptions, and exposure of **plaintext secrets** through `config.xml` handling. Organizations running self-managed Jenkins instances should prioritize upgrading to the fixed releases and review controller exposure, user permissions, and configuration handling paths that could allow low-privileged users to reach sensitive functionality.
Jun 29, 2026
Jenkins, a widely used open-source automation server, has released critical security updates to address multiple high-severity vulnerabilities that could expose CI/CD pipelines to significant risks. The most severe flaw, tracked as CVE-2025-67635, affects Jenkins versions 2.540 and earlier (including LTS 2.528.2 and earlier) and allows unauthenticated attackers to trigger denial-of-service (DoS) attacks via the HTTP-based command-line interface. This vulnerability arises from improper connection handling, where corrupted HTTP CLI streams are not properly closed, enabling attackers to exhaust server resources and render Jenkins instances unresponsive. Organizations relying on Jenkins are urged to upgrade to version 2.541 or LTS 2.528.3 to mitigate this risk. In addition to the DoS vulnerability, another high-severity issue, CVE-2025-67641, was identified in the Jenkins Coverage Plugin. This flaw allows attackers with "Item/Configure" permissions to exploit coverage reports for stored cross-site scripting (XSS) attacks by submitting malicious JavaScript via the REST API. If an administrator views a compromised report, the script executes, potentially leading to session hijacking. Both vulnerabilities have been addressed in the latest Jenkins security updates, and immediate patching is recommended to protect against exploitation.
Jun 29, 2026
**Jenkins** disclosed multiple security flaws affecting **Jenkins core** and the **LoadNinja Plugin**, with the most detailed reporting describing a **high-severity arbitrary file creation issue** tracked as `CVE-2026-33001` / `SECURITY-3657`. The flaw affects Jenkins weekly `2.554` and earlier and LTS `2.541.2` and earlier, and stems from unsafe handling of symbolic links during extraction of `.tar` and `.tar.gz` archives. A crafted archive can write files outside the intended directory, potentially enabling code execution by placing malicious content in locations such as `JENKINS_HOME/init.groovy.d/` or `JENKINS_HOME/plugins/`, particularly through artifact archiving features on the controller. Jenkins also reported a **high-severity DNS rebinding issue** in WebSocket CLI origin validation, tracked as `CVE-2026-33002` / `SECURITY-3674`, while the Canadian Centre for Cyber Security separately amplified the vendor advisory and urged administrators to apply updates. The fixes are available in **Jenkins 2.555** and **LTS 2.541.3**, and exploitation of the archive-handling flaw requires either `Item/Configure` permission or the ability to control agent processes. Other references in the set cover unrelated vendor advisories from **Citrix, VMware, Atlassian, Mitel, GNU, GitHub,** and **Spring** and do not describe the same event.
Jun 29, 2026