Vulnerability · Published Sep 16, 2026 · Assigned by jenkins
CVE-2026-92134
High 8.0
In plain English
A high-severity cross-site scripting in Jenkins Warnings Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.4%top 64.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins Warnings Plugin | see references |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- Jenkins Security Advisory 2026-09-16 vendor-advisory