CVE-2026-27100: Jenkins Core Build Information Disclosure Vulnerability
Summary
CVE-2026-27100: Jenkins has a build information disclosure vulnerability through Run Parameter. Affects org.jenkins-ci.main:jenkins-core versions < 2.551. Fixed in 2.551. How to fix ↓
Also tracked for
- jenkins · Bitnami
The same CVE-2026-27100 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server widely used for continuous integration and continuous delivery (CI/CD). It allows developers to automate the building, testing, and deployment of software. Jenkins is highly extensible, with a rich ecosystem of plugins that enhance its functionality. However, certain versions of Jenkins have a vulnerability that can expose sensitive build information to unauthorized users.
Vulnerability Detail
The vulnerability in Jenkins versions 2.550 and earlier, including LTS 2.541.1 and earlier, allows users with limited permissions (Item/Build and Item/Configure) to access Run Parameter values that reference builds they do not have permission to view. This can lead to information disclosure regarding the existence of jobs and builds, as well as the display names of specific builds. Attackers can exploit this vulnerability to gather sensitive information about the Jenkins environment, potentially leading to further attacks.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.551
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the permissions of users who have Item/Build and Item/Configure permissions to prevent them from accessing sensitive build information until the Jenkins instance can be updated.
Conclusion
The Jenkins build information disclosure vulnerability (CVE-2026-27100) poses a moderate risk to users of affected versions. It is crucial to update to version 2.551 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
CVE-2026-27100 is a vulnerability in Jenkins that allows unauthorized users to access sensitive build information through Run Parameter values.
Jenkins versions 2.550 and earlier, as well as LTS 2.541.1 and earlier, are affected by this vulnerability.
The vulnerability can lead to unauthorized disclosure of job and build information, which may assist attackers in planning further attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider restricting user permissions as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
