BIT-JENKINS-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

PT-2026-88173

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

EUVD-2026-70137

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

CVE-2026-84669

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

CVE-2026-84669

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

CVE-2026-84669

The Jenkins Allure Plugin (allure-jenkins-plugin) version 2.35.2 and earlier is vulnerable to a path traversal vulnerability. The root cause is the failure to correctly validate file paths when serving Allure report results. An attacker with Item/Read permission on jobs that publish Allure report...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

CVE-2026-84656 is a missing permission check in Jenkins (2.579 and earlier, LTS 2.568.2 and earlier) that allows an attacker holding Item/Read permission on at least one job to read build parameter names and values of jobs they do not otherwise have access to. The flaw is a privilege-boundary fai...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

PT-2026-84792

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

Path traversal vulnerability in allure-jenkins-plugin

allure-jenkins-plugin 2.35.2 and earlier does not correctly validate file paths when serving Allure report results. This allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system. allure-jenkins-plugin...

CVE-2026-84669: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

Missing Authorization

Overview org.jenkins-ci.plugins:git-parameter is a plugin that allows you to assign git branch, tag, pull request or revision number as parameter in your builds. Affected versions of this package are vulnerable to Missing Authorization due to a missing permission check in the process. An attacker...

CVE-2026-57300

A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...

CVE-2026-57286

A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata...

CVE-2026-57300

The Jenkins MCP Server Plugin (version 0.177.v629fdb_2557fe and earlier) contains a missing permission check in the getReplayScripts MCP tool. This flaw allows attackers who possess Item/Read permissions to unauthorizedly read the Pipeline replay scripts of jobs they can access. The impact is the...

EUVD-2026-38781

A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...