Jenkins Patches High-Severity Plugin Vulnerability Including Path Traversal and Stored XSS

Jenkins published a security advisory (April 29, 2026) addressing seven plugin vulnerabilities—three High severity—that include a path traversal leading to possible remote code execution (CVE-2026-42520) in the Credentials Binding Plugin, stored XSS in the GitHub and HTML Publisher plugins, unsafe deserialization, missing permission checks, and an open redirect. The advisory lists affected versions and fixed releases for each CVE and urges administrators to immediately apply the patched plugin versions via the Jenkins Plugin Manager, prioritizing the Credentials Binding and GitHub Plugin updates.