BIT-GITEA-2026-104626 Gitea fork workflow job revival through later approval

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the...

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the...

EUVD-2026-85614

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...

EUVD-2026-58128

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53441 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53441 Source advisory: SNYK:JAVA-ORGJENKINSCIMAIN-17337043...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53439 Source advisory: GHSA-G28P-6MCC-V4RV...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53436 Source advisory: GHSA-3RQH-HCH3-JHPC...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53439 Source advisory: OSV:GHSA-G28P-6MCC-V4RV...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53436 Source advisory: OSV:GHSA-3RQH-HCH3-JHPC...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53438 Source advisory: OSV:GHSA-MW82-XCG6-GX79...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53435 Source advisory: OSV:GHSA-G2XQ-2V27-4RH3...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53437 Source advisory: GHSA-463R-5M89-4XFR...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53442 Source advisory: OSV:GHSA-M6WV-WH8G-64XC...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53437 Source advisory: MEND:CVE-2026-53437...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53436 Source advisory: MEND:CVE-2026-53436...

org.jenkins-ci.main:jenkins-test-harness (1.572), org.jenkins-ci.main:jenkins-war (1.572) +14 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (1.572)

org.jenkins-ci.main:jenkins-core MAVEN version 1.572 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.572 - org.jenkins-ci.main:jenkins-war 1.572 -...

CVE-2023-35146: Improper Neutralization of Input During Web Page Generation

Jenkins Template Workflows Plugin 41.v32d86a313b4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create jobs...

Cross-site Scripting (XSS)

workflow-job is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the displayName attribute of the summary.jelly does not escape before being rendered, allowing an attacker to inject and execute malicious JavaScript...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.4), org.jvnet.hudson.plugins:analysis-collector (1.44) +1 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1.4)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.4 -...