GitHub Advisoryadvisory · Maven

GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter

MEDIUM Published 2026-02-18 Modified 2026-02-25 Official page ↗
Aliases
CVE-2026-27100
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-02-19

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.542, < 2.551 → fixed in 2.551 • Maven org.jenkins-ci.main:jenkins-core: < 2.541.2 → fixed in 2.541.2

Description

Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.

Related

Alias · CVE (1)

  • CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References