Jenkins Releases Fixes for 20 Plugin Vulnerabilities Including 7 RCE Flaws

The Jenkins project issued a security advisory on September 16, 2026, disclosing 20 plugin vulnerabilities, seven of which allow arbitrary code execution on the controller by bypassing the Script Security sandbox. Affected plugins include Script Security, Robot Framework, Gradle, Bitbucket, Warnings, Coverage, and Dependency-Check, all of which have patches available. Administrators are urged to audit installed plugin versions carefully, as plugin updates can fail silently and core Jenkins upgrades do not address plugin-level flaws. No active exploitation or public proof-of-concept had been confirmed at the time of disclosure, though teams with broadly granted Pipeline authoring rights face elevated risk. Beyond patching, security guidance recommends rotating credentials accessible from controller-level jobs and reviewing job definitions and build histories for any signs of unauthorized activity during the exposure window.