Jenkins Vulnerabilities Allow Code Execution and Info Disclosure

CERT-Bund has released Security Advisory WID-SEC-2026-0779 concerning critical vulnerabilities in Jenkins. The advisory highlights multiple flaws that, if exploited, could lead to arbitrary code execution, security bypass, and unauthorized disclosure of sensitive information. The vulnerabilities affect Jenkins weekly versions prior to 2.555 and Jenkins LTS versions prior to 2.541.3, as well as the Jenkins LoadNinja Plugin version <2.2. The advisory notes a high CVSS base score of 8.8, indicating a significant security risk.

Organizations utilizing affected Jenkins versions must take immediate action to mitigate these risks. Recommended actions include updating Jenkins to the patched versions (Jenkins weekly >=2.555 and Jenkins LTS >=2.541.3) or applying available mitigations if immediate patching is not feasible. Failure to address these vulnerabilities could result in severe security breaches, including system compromise and data exfiltration. The advisory provides links to CVE information and version history for further details.