CVE-2020-2226

The CVE-2020-2226 issue affects Jenkins Matrix Authorization Strategy Plugin, version 2.6.1 and earlier, where user names shown in the configuration were not escaped, enabling a stored cross-site scripting (XSS) vulnerability. The vulnerability can be exploited by users with Job/Configure or Agen...

CVE-2021-21623

CVE-2021-21623: Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier contains an incorrect permission check that lets users with Item/Read on nested items access those items, even if they lack Item/Read on the parent folders. The issue is documented across multiple sources (OSV, NVD, CN...

CVE-2026-42521

The Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 (both inclusive) are vulnerable to unsafe deserialization. When deserializing inheritance strategies, the plugin invokes parameterless constructors of classes specified in the configuration without restricting whic...