Jenkins patches 20 flaws, 13 of them rated high

Jenkins published Security Advisory 2026-09-16 on 16 September, covering 20 CVEs across 13 plugins. Thirteen of the twenty are rated high severity, and the headline problem is familiar territory for anyone who administers a build server: the sandbox that is supposed to stop untrusted pipeline code from running wild.

The sandbox bypasses

Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier fails to intercept several Groovy operations, including method calls and property accesses on a null receiver and the coercion of a value to an interface. An attacker with permission to define and run sandboxed scripts, which includes ordinary Pipelines, can use those gaps to escape the sandbox and execute arbitrary code in the Jenkins controller's JVM. The advisory lists six sandbox bypasses and a classpath approval bypass for the plugin, tracked as SECURITY-3923 through SECURITY-3931, and fixes them in Script Security Plugin 1422.v06869826dd9b.

What else is in the batch

The remaining issues spread across the wider plugin set: path traversal in Pipeline: Groovy Libraries and Robot Framework, stored cross-site scripting in Warnings, Coverage and Gitee, an open redirect in Keycloak Authentication, and further fixes in GitLab, Gradle, OWASP Dependency-Check, Bitbucket Push and Pull Request, Bitbucket Server Integration and Pipeline: Multibranch. Severity is not uniform, but every item in the list has a patched version named in the advisory, so the practical question for an administrator is which of those thirteen plugins is actually installed.

Why the reports keep coming

Jenkins runs its security process on a fixed schedule and credits researchers through a bug bounty programme sponsored by the European Commission, which is why batches this size arrive as a single dated advisory rather than a slow trickle. For defenders that is useful: a version check against one page tells you whether your instance is current, instead of a monthly hunt through release notes.

Our opinion

The uncomfortable part of Jenkins security is that your exposure is not really Jenkins. It is the thirteen plugins somebody installed in 2021 to make a pipeline go faster and then forgot about. Two of those plugins are called Coverage and Warnings; both are the sort of thing that gets added for a dashboard and never removed. Every one of them is now somebody's patch ticket.

The sandbox bypass deserves priority treatment precisely because it does not need a vulnerability in anything else. Anyone who can push a Jenkinsfile, which on most teams is most of the engineering department, is a candidate attacker, and the reward is code execution on the box that holds every credential your delivery pipeline touches. Update Script Security first, then work through the rest of the list before the weekend. This is the least exciting kind of security advice, which is probably why it keeps getting deferred.