Skip to content
ThreatCluster

Critical Vulnerabilities Discovered in Jenkins Plugins

First seen 28 May 2026, 21:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •May 29, 2026 at 21:11 UTC
  • •CVE-2026-48922 allows remote code execution via the Credentials Binding Plugin.
  • •CVE-2026-48925 enables CSRF attacks in the GitHub Integration Plugin.
  • •Both vulnerabilities were published on May 27, 2026, and require urgent attention.

Two significant vulnerabilities have been identified in Jenkins plugins, CVE-2026-48922 and CVE-2026-48925. The Jenkins Credentials Binding Plugin allows attackers to write files to arbitrary locations, potentially leading to remote code execution. This affects versions 720.v3f6decef43ea_ and earlier. The second vulnerability, CVE-2026-48925, is a cross-site request forgery (CSRF) flaw in the Jenkins GitHub Integration Plugin, enabling attackers to trigger builds for pull requests. Both vulnerabilities were published on May 27, 2026, and pose serious risks to Jenkins users. Immediate action is recommended to mitigate these threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 146d ago How this analysis works

Timeline

2026-05-27
CVE-2026-48922 published
A vulnerability in the Jenkins Credentials Binding Plugin allows arbitrary file writing, risking remote code execution.
Nvd.Nist
2026-05-27
CVE-2026-48925 published
A CSRF vulnerability in the Jenkins GitHub Integration Plugin allows unauthorized build triggers for pull requests.
Nvd.Nist
2026-05-28
Security advisory issued
Jenkins users are advised to update their plugins immediately to mitigate the identified vulnerabilities.
Nvd.Nist

More articles in this cluster (4)

Following this threat?

Track CVE-2026-48922 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3