Jenkins GitHub Plugin: stored XSS via job URL lets any authenticated user run script in an admin's session

Impact

The plugin builds the client-side validation for "GitHub hook trigger for GITScm polling" from the current job URL without escaping it, so a user who can create or name a job can store script that executes in the browser of anyone who later views it. The CVSS vector is scored with a changed scope and full confidentiality, integrity and availability impact, which in Jenkins terms means riding an administrator's session: crafted requests can reach script console or credential endpoints with the victim's rights. For a GPU fleet this matters because Jenkins usually holds the registry credentials, the kubeconfig and the signing keys used to push images onto the nodes, so a hijacked admin session is a path into the build and deploy pipeline rather than just a defaced page. Exploitation needs an existing account - it is an internal privilege-escalation problem, not an anonymous internet one.

Who can reach it

A non-anonymous Jenkins user with Overall/Read permission stores the payload; it fires when a more privileged user (typically an administrator) views the affected page, so it requires authentication plus victim interaction.

What to do

Update the Jenkins GitHub Plugin past 1.46.0 to the version named in the Jenkins security advisory of 2026-04-29 (SECURITY-3704) and restart or reload the controller - plugin updates are a controller restart, not a node drain, and build agents and running GPU jobs are unaffected. Until then, reduce who holds Overall/Read and job-create permission on the controller.

References

Related entries

• Woodpecker CI: pipeline authors can pick any ServiceAccount for their build podsCVE-2026-61549 · Woodpecker CI Kubernetes backend (backend_options.kubernetes.serviceAccountName)Critical
• Jenkins Remoting: JEP-200 deserialization filter bypassed via fallback class resolution on the controllerCVE-2026-70426 · Jenkins Remoting (JEP-200 deserialization class filter, fallback resolution path)Critical
• Crossplane package manager (cosign signature verification via ImageConfig): SUPPLY CHAIN, TIME-OF-CHECK TO TIME-OF-USENCVD-2026-055-crossplane-package-manager-cosig · Crossplane package manager (cosign signature verification via ImageConfig)Critical
• Ceph CephX: malleable, unauthenticated tickets let a low-privilege key be forged into Manager, MDS or OSD accessCVE-2025-30156 · Ceph CephX authentication protocol (unauthenticated AES-128-CBC ticket encryption)High
• Grafana: authenticated user can read SSO client secrets and change instance-wide SSO settingsCVE-2026-103506 · Grafana (kubernetesSsoSettingsApi SSO settings endpoint)High
• NetBird client: unescaped peer hostname injects OpenSSH config directives and runs commands on other peersCVE-2026-105429 · NetBird client SSH config manager (/etc/ssh/ssh_config.d/99-netbird.conf generation)High