Jenkins vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Jenkins flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2017-1000353 Jenkins Remote Code ExecutionExploited since Oct 2, 2025 · CVSS 9.8
• CVE-2024-23897 Jenkins Command Line Interface (CLI) Path TraversalExploited since Aug 19, 2024 · ransomware · CVSS 9.8
• CVE-2015-5317 Jenkins User Interface (UI) Information DisclosureExploited since May 12, 2023 · CVSS 7.5
• CVE-2019-1003029 Jenkins Script Security Plugin Sandbox BypassExploited since Apr 25, 2022 · CVSS 9.9
• CVE-2019-1003030 Jenkins Matrix Project Plugin Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 9.9
• CVE-2018-1000861 Jenkins Stapler Web Framework Deserialization of Untrusted DataExploited since Feb 10, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2024-23897 Jenkins Command Line Interface (CLI) Path TraversalExploited · Critical 9.8 · Jan 24, 2024
• CVE-2012-4438 Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitraryHigh 8.8 · Nov 18, 2019
• CVE-2019-1003030 Jenkins Matrix Project Plugin Remote Code ExecutionExploited · Critical 9.9 · Mar 8, 2019
• CVE-2019-1003029 Jenkins Script Security Plugin Sandbox BypassExploited · Critical 9.9 · Mar 8, 2019
• CVE-2018-1000417 A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creaHigh 8.1 · Jan 9, 2019
• CVE-2018-1000414 A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.jHigh 8.1 · Jan 9, 2019
• CVE-2018-1000412 An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have High 8.8 · Jan 9, 2019
• CVE-2018-1000410 An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/srHigh 7.8 · Jan 9, 2019
• CVE-2018-1000866 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.High 8.8 · Dec 10, 2018
• CVE-2018-1000865 A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.jHigh 8.8 · Dec 10, 2018
• CVE-2018-1000863 A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit craHigh 8.2 · Dec 10, 2018
• CVE-2018-1000861 Jenkins Stapler Web Framework Deserialization of Untrusted DataExploited · Critical 9.8 · Dec 10, 2018
• CVE-2018-1999043 A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.jHigh 7.5 · Aug 23, 2018
• CVE-2018-1999040 An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to captuHigh 8.8 · Aug 1, 2018
• CVE-2018-1999035 A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMastHigh 7.4 · Aug 1, 2018
• CVE-2018-1999034 A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that alloHigh 7.4 · Aug 1, 2018
• CVE-2018-1999028 An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credeHigh 8.8 · Aug 1, 2018
• CVE-2018-1999027 An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attHigh 7.5 · Aug 1, 2018
• CVE-2018-1999025 A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers toHigh 7.4 · Aug 1, 2018
• CVE-2018-1999002 A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java thaHigh 7.5 · Jul 23, 2018
• CVE-2018-1999001 A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to providHigh 8.8 · Jul 23, 2018
• CVE-2018-1000404 Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CoHigh 7.8 · Jul 9, 2018
• CVE-2018-1000403 Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher.jHigh 7.8 · Jul 9, 2018
• CVE-2018-1000401 Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.javHigh 7.8 · Jul 9, 2018
• CVE-2018-1000610 A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.High 8.8 · Jun 26, 2018