Jenkins JDepend Plugin: unconfigured XML parser allows XXE from a build's JDepend report

Impact

The plugin ships an outdated JDepend Maven Plugin whose XML parser does not disable external entities, so a JDepend report processed by a build can make the Jenkins controller read files it should not and reach out to URLs on its behalf. On a Jenkins instance that drives GPU fleet CI - building container images, pushing models, holding registry and cluster credentials - controller-side file read is the path to those secrets. Exposure is limited to instances with this plugin installed and jobs whose workspace content an attacker can influence.

Who can reach it

A user who can control the JDepend report content a build parses - in practice someone with permission to configure a job or to land code in a repository the job builds. Authenticated access to Jenkins, or commit access to a built repository, is required.

What to do

No fixed version is listed in the advisory: 1.3.1 and earlier are affected. Uninstall or disable the JDepend Plugin on affected controllers, or stop running jobs whose JDepend input is attacker-influenced, until a release appears. Removing a plugin restarts nothing beyond the controller reload Jenkins already does for plugin changes; no agent or node work is needed.

References

Related entries

• AMD Zen 5 RDSEED (16-bit and 32-bit variants): On Zen 5, the 16-bit and 32-bit forms of RDSEED return zero far moreCVE-2025-68313 · AMD Zen 5 RDSEED (16-bit and 32-bit variants)High
• adm-zip: extracted zip entries keep setuid/setgid bits, planting root setuid binaries in builds run as rootCVE-2026-102282 · adm-zip (Node.js zip extraction, keepOriginalPermission mode)High
• Flyte: FILE-mounted secrets land in pod spec env vars, readable by anyone with pod readCVE-2026-108728 · Flyte secrets webhook (FILE-mounted secrets written to the SECRETS env var)High
• Grafana: Auth Proxy cache key collision authenticates a low-privileged user as an administratorCVE-2026-14199 · Grafana Auth Proxy authentication (identity cache key built by concatenation)High
• GitLab EE: missing authorization lets a low-privileged member change restricted project settingsCVE-2026-16494 · GitLab EE (project update endpoint authorization)High
• Grafana: alert rule marked as a server-side expression bypasses datasource query authorizationCVE-2026-17183 · Grafana (alert rule server-side expression datasource authorization)High