CVE-2026-92132

5.4 Moyenne

Publiée le 16/09/2026 à 16:17 · Modifiée le 18/09/2026 à 15:46 · En attente d'analyse NVD · Source : jenkinsci-cert@googlegroups.com

Description

Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.

Traduire en français

Produits concernés

Jenkins Project Jenkins Gradle Plugin

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-74

Références

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-4028

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories