Jenkins Security Update Patches Sandbox Bypass, Command Injection, and CSRF Bugs

Jenkins published an advisory (June 24, 2026) disclosing 26 vulnerabilities across 18 plugins, including critical Groovy sandbox bypasses (CVE-2026-57280, CVE-2026-57281) enabling arbitrary code execution on controllers, path-traversal (External Workspace Manager), shell injection via SSH wrapper generation (Git client), multiple CSRF and permission-check failures across plugins, LDAP injection, XXE, and plaintext credential storage; administrators are urged to update affected plugins and consider disabling plugins without fixes (Assembla, FitNesse, OWASP ZAP, Zowe).