CVE-2026-42523: Jenkins GitHub Plugin XSS Vulnerability

CVE-2026-42523 Overview

CVE-2026-42523 is a stored cross-site scripting (XSS) vulnerability affecting Jenkins GitHub Plugin version 1.46.0 and earlier. The plugin improperly processes the current job URL inside JavaScript that validates the GitHub hook trigger for GITScm polling feature. Authenticated attackers with Overall/Read permission can inject script payloads that execute in the browsers of other Jenkins users. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Successful exploitation can lead to session compromise, credential theft, and pivoting into administrative Jenkins functions.

Critical Impact
Authenticated attackers with minimal Jenkins permissions can execute arbitrary JavaScript in other users' sessions, potentially hijacking administrator accounts and compromising the build pipeline.

Affected Products

Jenkins GitHub Plugin versions 1.46.0 and earlier
Jenkins controllers using the GitHub Plugin with GitHub hook trigger for GITScm polling enabled
Jenkins environments allowing Overall/Read permission to non-anonymous users

Discovery Timeline

2026-04-29 - Jenkins publishes security advisory SECURITY-3704
2026-04-29 - CVE-2026-42523 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-42523

Vulnerability Analysis

The Jenkins GitHub Plugin renders a form control that validates whether the GitHub hook trigger for GITScm polling feature is correctly configured. The validation logic is implemented in client-side JavaScript that consumes the current job URL without proper output encoding. Because Jenkins permits a wide range of characters in job names, an attacker who can create or rename a job can embed payloads that the validation script subsequently interprets as executable script. The resulting payload persists in the job configuration and triggers whenever another authenticated user opens the affected configuration view. The scope-changed nature of the issue (S:C in the CVSS vector) reflects that the script executes within the Jenkins web UI under a different user's session, extending impact beyond the attacker's own permissions.

Root Cause

The root cause is missing contextual escaping of the job URL when it is interpolated into JavaScript. Jenkins treats the URL fragment as a trusted string rather than untrusted user input, allowing characters that break out of the intended string context. This pattern is a classic stored XSS where persistent configuration data is reflected into a script sink without sanitization.

Attack Vector

An attacker authenticated with Overall/Read permission creates or modifies a job whose name or URL encodes JavaScript syntax. The attacker then waits for or socially engineers a higher-privileged user to view the job configuration page. When the validation script executes, the injected payload runs in the victim's browser with that user's Jenkins session, enabling actions such as creating administrator accounts, exfiltrating credentials stored in Jenkins, or modifying build configurations to deliver malicious artifacts.

// No verified public proof-of-concept is available.
// See the Jenkins Security Advisory referenced below for technical details.

Detection Methods for CVE-2026-42523

Indicators of Compromise

Unexpected creation or renaming of Jenkins jobs containing unusual characters such as <, >, quotes, or script-like substrings in the job name or URL
New administrator accounts or API tokens created shortly after an authorized user viewed a suspicious job configuration
Outbound HTTP requests from Jenkins user browsers to attacker-controlled domains coinciding with Jenkins UI navigation
Audit log entries showing job edits by low-privilege accounts immediately preceding privilege escalation events

Detection Strategies

Inventory installed plugins and flag any Jenkins controller running GitHub Plugin 1.46.0 or earlier
Review job configuration history for non-standard characters in job names that could indicate XSS payload staging
Correlate Overall/Read user activity with subsequent administrative actions performed under different accounts within a short time window
Inspect browser Content Security Policy (CSP) violation reports for blocked inline scripts originating from Jenkins job configuration pages

Monitoring Recommendations

Enable and centralize Jenkins audit logs covering job creation, renaming, and configuration changes
Monitor for sudden permission grants, new credentials, or pipeline definition changes following job views
Alert on logins or API token creation from anomalous IP addresses, especially for administrator accounts
Track plugin version drift across Jenkins controllers to catch unpatched instances

How to Mitigate CVE-2026-42523

Immediate Actions Required

Upgrade Jenkins GitHub Plugin to a version later than 1.46.0 once a fixed release is available per the Jenkins Security Advisory
Audit all existing jobs for suspicious names or URL fragments and remove any containing script-like content
Restrict Overall/Read permission to trusted users until the plugin is patched
Rotate Jenkins API tokens and credentials if suspicious job modifications are discovered

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3704 for the official fixed version and upgrade instructions. Apply the update through the Jenkins Update Center or by replacing the plugin HPI file on the controller and restarting the service.

Workarounds

Disable the GitHub Plugin where the GitHub hook trigger for GITScm polling feature is not required
Tighten the Jenkins authorization strategy to remove Overall/Read from anonymous and low-trust accounts
Enforce a strict Content-Security-Policy that blocks inline script execution in Jenkins UI pages
Require administrators to review job configurations only from hardened, isolated browser sessions

bash

# Check the installed Jenkins GitHub Plugin version
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="github") | {shortName, version, enabled}'

# Remove Overall/Read from the anonymous user via Jenkins CLI script console
# (run in Manage Jenkins > Script Console)
# jenkins.model.Jenkins.instance.getAuthorizationStrategy()