CVE-2018-1000146: Liquibase Runner Plugin Arbitrary Code Execution
Summary
CVE-2018-1000146: Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM. Affects org.jenkins-ci.plugins:liquibase-runner versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liquibase Runner Plugin is a Maven package used in Jenkins, an open-source automation server. It allows users to manage database changes using Liquibase, a database schema management tool. The plugin integrates Liquibase functionality into Jenkins, providing a convenient way to execute Liquibase commands as part of Jenkins jobs. However, versions 1.3.0 and older of the plugin are vulnerable to arbitrary code execution.
Vulnerability Detail
The Liquibase Runner Plugin version 1.3.0 and older suffer from an arbitrary code execution vulnerability. This vulnerability allows an attacker with permission to configure jobs in Jenkins to load and execute arbitrary Java code on the Jenkins master JVM. By exploiting this vulnerability, an attacker can gain unauthorized access to the Jenkins server and potentially perform malicious actions, such as stealing sensitive data, modifying configurations, or launching further attacks.
How To Fix
Latest published version: 1.4.10 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or remove the Liquibase Runner Plugin if it is not essential for their Jenkins setup. This can be done by navigating to the Jenkins plugin management page and disabling or uninstalling the plugin. However, this workaround may impact any jobs or processes relying on the plugin's functionality.
Conclusion
The Liquibase Runner Plugin version 1.3.0 and older in Jenkins are vulnerable to arbitrary code execution. To mitigate this risk, it is recommended to upgrade to version 1.4.3 or newer of the plugin. Regularly updating all plugins and Jenkins itself is crucial for maintaining a secure Jenkins environment. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:liquibase-runner →
FAQ
The vulnerability allows an attacker to execute arbitrary Java code on the Jenkins master JVM, potentially leading to unauthorized access, data theft, and further compromise of the Jenkins server.
Users of Jenkins with the Liquibase Runner Plugin versions 1.3.0 and older are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
No, this vulnerability requires an attacker to have permission to configure jobs in Jenkins. It cannot be exploited remotely without prior access to the Jenkins server.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is essential to apply the fix as soon as possible to prevent potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:liquibase-runner.
