Jenkins Ivy Report Plugin: XXE in Ivy report parsing gives an authenticated user file read on the controller

Impact

The plugin parses Ivy report files without disabling external entities, so a user who can influence a build's Ivy report can make the Jenkins controller resolve attacker-chosen entities. That yields file reads on the controller and outbound requests from it - and a CI controller in a GPU fleet is usually holding registry credentials, kubeconfigs, and cluster service-account tokens, which makes controller file read a credential-theft problem rather than an information leak. Exposure is entirely conditional on having this specific plugin installed; most Jenkins instances do not. NVD scores it 7.1 with low privileges required, so an ordinary job-configuring user is enough.

Who can reach it

Authenticated Jenkins user with enough permission to run or configure a job that produces an Ivy report the plugin then parses. Not reachable unauthenticated, and not reachable at all if the plugin is not installed.

What to do

First check whether the plugin is installed at all (Manage Jenkins - Plugins); if it is not, there is nothing to do. The Jenkins advisory covers version 1.2 and earlier - consult SECURITY-3899 for whether a fixed release exists, and do not assume one from this record. If no fix is listed, uninstall the plugin; either way the change requires a controller restart, which interrupts running builds but touches no GPU nodes.

References

Related entries

• Determined AI (master API, generic task kill/pause/unpause handlers): The generic task kill, pause and unpauseCVE-2026-75109 · Determined AI (master API, generic task kill/pause/unpause handlers)High
• Flux CD (allow-webhooks NetworkPolicy, notification-controller event server): CROSS-TENANT EVENT FORGERY: theNCVD-2026-057-flux-cd-allow-webhooks-networkpo · Flux CD (allow-webhooks NetworkPolicy, notification-controller event server)High
• OpenSSH through 10.0 - mm_answer_authpassword uses an integer 'authenticated' flag that does not resist a single bitCVE-2023-51767 · OpenSSH through 10.0 - mm_answer_authpassword uses an integer 'authenticated' flag that does not resist a single bit…High
• AMD Radeon RGB tool - signature verification on files in the installation directory: The Radeon RGB tool doesCVE-2024-36334 · AMD Radeon RGB tool - signature verification on files in the installation directoryHigh
• Intel Neural Compressor (SQL injection, second instance): A second SQL-injection path in Neural Compressor reachableCVE-2024-39766 · Intel Neural Compressor (SQL injection, second instance)High
• Redis: Authenticated user triggers a stack/heap out-of-bounds write in hyperloglog opsCVE-2025-32023 · RedisHigh