🔴 Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theft

Jenkins has released security updates addressing 20 vulnerabilities across 13 plugins, including multiple high-severity flaws that could allow authorized attackers to bypass Groovy sandbox protections and execute arbitrary code on Jenkins controllers.

The advisory, dated September 16, 2026, also addresses stored cross-site scripting (XSS), server-side request forgery (SSRF), credential exposure, path traversal, OAuth token hijacking, and an open redirect vulnerability affecting commonly deployed CI/CD integrations.