PT-2026-20434 · Jenkins+1 · Jenkins+1

Suman Roy · Published 2026-02-18 · Updated 2026-03-20 · CVE-2026-27100

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.550 and earlier Jenkins LTS versions 2.541.1 and earlier

Description The software allows access to information about jobs, builds, and build display names even when a user does not have permission to view them. This occurs because the software accepts Run Parameter values that reference builds inaccessible to the user submitting the build. An attacker with Item/Build and Item/Configure permission can exploit this.

Recommendations Update Jenkins to a version later than 2.550. Update Jenkins LTS to a version later than 2.541.1.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-05583

BIT-JENKINS-2026-27100

CVE-2026-27100

GHSA-WFHP-QGM8-5P5C

Affected Products

Jenkins

Red Os

References · 21

• https://jenkins.io/security/advisory/2026-02-18/#SECURITY-3658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27100 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2026-27100 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27100 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfhp-qgm8-5p5c · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05583 · Security Note
• https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.551 · Note
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/f92eadb5813f04ca27439455e2573c3171e93a45 · Note
• https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.541.2 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2026-27100-8.0 · Note
• https://twitter.com/dailytechonx/status/2025250426900152408 · Twitter Post
• https://t.me/CVEtracker/44991 · Telegram Post
• https://twitter.com/CVEnew/status/2024138071680405925 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024230725789106217 · Twitter Post