Jenkins Multijob Plugin: CSRF lets an attacker run code in the Jenkins controller JVM

Impact

An endpoint in the plugin lacks CSRF protection, so an attacker who gets an authenticated Jenkins user to load a crafted page can execute arbitrary code in the controller JVM with that user's session. Unlike the plugin's sandbox-bypass issue, this needs no Jenkins account of the attacker's own - only a victim who is already logged in, which on an internal CI server is most of the engineering team during working hours. The consequence is the same: code in the controller, where the credentials that push images and drive the GPU cluster live. Only installations running the Multijob Plugin are affected.

Who can reach it

Anyone who can get an authenticated Jenkins user to visit a page they control. No Jenkins credentials of the attacker's own; the victim's existing session supplies the authentication.

What to do

The record names Multijob Plugin 669.v9d96a_d9c71b_0 and earlier and does not state a fixed release - read the Jenkins 2026-08-05 advisory (SECURITY-3823) before planning the change. Where no fix is available, remove the plugin, and keep the Jenkins UI off general-purpose browsing paths (SSO plus network restriction on the controller) so a crafted page cannot reach it. Plugin removal or update requires a controller JVM restart, aborting running builds.

References

Related entries

• Linux octeontx2-af (Marvell OCTEON CN10K, LMTLINE mailbox handler): The OCTEON CN10K admin-function mailbox handlerCVE-2026-72045 · Linux octeontx2-af (Marvell OCTEON CN10K, LMTLINE mailbox handler)High
• Linux octeontx2-af (VF clobbering shared CGX PKIND state): PF and VF NIX logical functions that share a CGX MAC reuseCVE-2026-74527 · Linux octeontx2-af (VF clobbering shared CGX PKIND state)High
• SkyPilot (API server, service account role update authorization): SkyPilot never checks whether the caller is entitledCVE-2026-75481 · SkyPilot (API server, service account role update authorization)High
• Citrix NetScaler ADC/Gateway: memory overflow in Gateway and AAA vservers causes denial of serviceCVE-2026-8452 · Citrix NetScaler ADC / Gateway (Gateway and AAA virtual servers)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High
• KubeEdge (NodeUpgradeJob handler, v1alpha2 API): REMOTE CODE EXECUTION ON EDGE NODES through the upgrade path. TheNCVD-2026-052-kubeedge-nodeupgradejob-handler · KubeEdge (NodeUpgradeJob handler, v1alpha2 API)High