CVE-2026-92135 Jenkins Project CVE debrief

Who should care

Defenders responsible for Jenkins instances with the Coverage Plugin installed should assess exposure and verify the plugin version. Users with Item/Configure permissions should be cautious when submitting job configurations.

Why it matters

CVE-2026-92135 is a stored XSS vulnerability in Jenkins Coverage Plugin that allows attackers with Item/Configure permission to inject malicious JavaScript code. Defenders should verify plugin versions, restrict permissions, and monitor for suspicious activity.

• Attackers can inject malicious JavaScript code, potentially leading to unauthorized actions or data theft.
• Compromise of Jenkins instances can have a ripple effect on downstream systems or development pipelines.
• Defenders need to verify plugin versions and restrict permissions to mitigate the vulnerability.
• Incident response may be required to address potential exploitation.

Technical summary

The Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability. The vulnerability can be exploited by attackers with Item/Configure permission, potentially leading to unauthorized actions or data theft. Defenders should prioritize verifying the plugin version and restricting Item/Configure permissions to trusted users.

Defensive priority

Defenders should prioritize verifying the plugin version and restricting Item/Configure permissions to trusted users.

Recommended defensive actions

• Verify the Jenkins Coverage Plugin version and update to a non-vulnerable version if possible.
• Restrict Item/Configure permissions to trusted users.
• Monitor for suspicious activity on Jenkins instances.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the vendor's advisory is not provided. The Jenkins security advisory is referenced, but its contents are not detailed. The vulnerability has been publicly disclosed and defenders should verify the plugin version and restrict Item/Configure permissions to trusted users. The CVE record was published on 2026-09-16T14:17:15.493Z and has not been modified since then. No additional information is available on potential exploits or attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.