CVE-2022-34181: Agent-to-controller security bypass in Jenkins xUnit Plugin
Summary
CVE-2022-34181: Agent-to-controller security bypass in Jenkins xUnit Plugin. Affects org.jenkins-ci.plugins:xunit versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins xUnit Plugin is a Maven package that provides support for parsing test results in various formats and generating reports. It is commonly used in Jenkins CI/CD pipelines to analyze test results and generate visualizations. The plugin allows users to define custom directories for storing test results and provides functionality for agents to communicate with the Jenkins controller. However, versions 3.0.8 and earlier of the xUnit Plugin contain a security vulnerability that allows attackers with control over agent processes to bypass security measures and perform unauthorized actions on the Jenkins controller.
Vulnerability Detail
The vulnerability in xUnit Plugin 3.0.8 and earlier lies in the implementation of an agent-to-controller message. This message allows agents to create a user-specified directory on the Jenkins controller if it does not already exist and parse files inside it as test results. However, this functionality can be exploited by attackers with control over agent processes to create arbitrary directories on the Jenkins controller or access test results from existing files in an attacker-specified directory. This can lead to unauthorized access, data leakage, and potential compromise of the Jenkins controller. The xUnit Plugin 3.1.0 release addresses this vulnerability by changing the message type from agent-to-controller to controller-to-agent, preventing execution on the controller.
How To Fix
Latest published version: 3.1.7 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly recommended to upgrade to the latest version of the xUnit Plugin to mitigate the risk.
Conclusion
The Agent-to-controller security bypass vulnerability in Jenkins xUnit Plugin versions 3.0.8 and earlier can allow attackers with control over agent processes to perform unauthorized actions on the Jenkins controller. To mitigate this risk, it is recommended to upgrade to the latest version of the xUnit Plugin (3.1.0 or later). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:xunit →
FAQ
This vulnerability allows attackers with control over agent processes to bypass security measures and perform unauthorized actions on the Jenkins controller, potentially leading to unauthorized access, data leakage, and compromise of the Jenkins controller.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide the pom.xml file of your Jenkins project, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
There are currently no known public exploits for this vulnerability. However, it is important to promptly upgrade to the latest version of the xUnit Plugin to mitigate the risk.
No, this vulnerability requires control over agent processes in order to exploit it. However, it is still important to address the vulnerability to prevent potential compromise of the Jenkins controller.
You can find more information about this vulnerability, including the Common Vulnerabilities and Exposures (CVE) identifier, in the official GitHub Advisory Database (https://github.com/github/advisory-database).
