CVE-2026-27100

MEDIUM4.3EPSS 0.35%

Jenkins has a build information disclosure vulnerability through Run Parameter

發布日:2026/2/18修改日:2026/2/25

也稱為:GHSA-wfhp-qgm8-5p5cBIT-jenkins-2026-27100CGA-v589-93qp-5cvx

描述

Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.

受影響套件(2)

Bitnami/jenkins>= 2.483.0, < 2.541.2, >= 2.542.0, < 2.551.0
Maven/org.jenkins-ci.main:jenkins-core>= 2.542, < 2.551

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-27100
PATCHhttps://github.com/jenkinsci/jenkins
WEBhttps://github.com/jenkinsci/jenkins/commit/f92eadb5813f04ca27439455e2573c3171e93a45
WEBhttps://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.541.2
WEBhttps://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.551
WEBhttps://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3658