io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53436 Source advisory: OSV:GHSA-3RQH-HCH3-JHPC...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53441 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53441 Source advisory: SNYK:JAVA-ORGJENKINSCIMAIN-17337043...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53436 Source advisory: GHSA-3RQH-HCH3-JHPC...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53439 Source advisory: OSV:GHSA-G28P-6MCC-V4RV...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53438 Source advisory: OSV:GHSA-MW82-XCG6-GX79...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53435 Source advisory: OSV:GHSA-G2XQ-2V27-4RH3...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53437 Source advisory: GHSA-463R-5M89-4XFR...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53442 Source advisory: OSV:GHSA-M6WV-WH8G-64XC...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53439 Source advisory: GHSA-G28P-6MCC-V4RV...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53437 Source advisory: MEND:CVE-2026-53437...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53436 Source advisory: MEND:CVE-2026-53436...

Incorrect permission checks in role-strategy

Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them e.g., Overall/Administer or Item/Configure. role-strategy...

org.jenkins-ci.plugins:role-strategy (>=2.4.0, <=2.6.0), org.jenkins-ci.plugins:view-job-filters (>=2.0.0, <=2.0.2) potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.0)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.plugins:role-strategy =2.4.0, =2.0.0, =2.0.2 Source cves: CVE-2021-21623 Sourc...

com.synopsys.jenkinsci:ownership (>=0.11.0, <=0.13.0), org.jenkins-ci.plugins:azure-ad (>=0.1.1, <=0.2.0) +1 more potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.7)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - com.synopsys.jenkinsci:ownership =0.11.0, =0.1.1, =2.6.1, =2.9.0 Source cves: CVE-2021-21623...

org.jenkins-ci.plugins:role-strategy (>=2.4.0, <=2.6.0), org.jenkins-ci.plugins:view-job-filters (>=2.0.0, <=2.0.2) potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.0)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.plugins:role-strategy =2.4.0, =2.0.0, =2.0.2 Source cves: CVE-2020-2226 Source...

com.synopsys.jenkinsci:ownership (>=0.11.0, <=0.13.0), org.jenkins-ci.plugins:azure-ad (>=0.1.1, <=0.2.0) +1 more potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.7)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - com.synopsys.jenkinsci:ownership =0.11.0, =0.1.1, =2.6.1, =2.9.0 Source cves: CVE-2020-2226...

org.jenkins-ci.main:jenkins-test-harness (1.473), org.jenkins-ci.main:jenkins-war (1.473) +5 more potentially affected by CVE-2020-2099 via org.jenkins-ci.main:jenkins-core (1.473)

org.jenkins-ci.main:jenkins-core MAVEN version 1.473 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.473 - org.jenkins-ci.main:jenkins-war 1.473 -...

org.jenkins-ci.main:jenkins-test-harness (1.473), org.jenkins-ci.main:jenkins-war (1.473) +5 more potentially affected by CVE-2020-2101 via org.jenkins-ci.main:jenkins-core (1.473)

org.jenkins-ci.main:jenkins-core MAVEN version 1.473 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.473 - org.jenkins-ci.main:jenkins-war 1.473 -...

Incorrect permission checks in role-strategy may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. role-strategy 3.1 and earlier does not correctly perform permission checks to determine whether an item...

Improper authorization due to caching in role-strategy

role-strategy 2.12 and newer uses a cache to speed up permission lookups. In role-strategy 3.0 and earlier this cache is not invalidated properly when an administrator changes the permission configuration. This can result in permissions being granted long after the configuration was changed to no...