CVE-2026-70441: Jenkins Summary Display Plugin XSS Flaw

CVE-2026-70441 Overview

CVE-2026-70441 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Summary Display Plugin version 1.15 and earlier. The plugin fails to escape the job name in a JavaScript context on build report pages. Attackers with Item/Create or Item/Configure permission can inject malicious script that executes in the browsers of users viewing affected build reports. The flaw is tracked under CWE-79 and disclosed in Jenkins Security Advisory SECURITY-3750.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in other Jenkins users' browsers, enabling session theft, privilege abuse, and pivoting within the CI/CD environment.

Affected Products

Jenkins Summary Display Plugin version 1.15
Jenkins Summary Display Plugin versions earlier than 1.15
Jenkins controllers running the vulnerable plugin with Item/Create or Item/Configure permission delegated to non-administrators

Discovery Timeline

2026-08-05 - CVE-2026-70441 published to NVD
2026-08-05 - Jenkins publishes Security Advisory SECURITY-3750
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70441

Vulnerability Analysis

The Summary Display Plugin renders build report pages that embed the job name inside a JavaScript context. The plugin does not apply JavaScript-context escaping before writing the job name into the page. An attacker who can create or configure a job supplies a name containing script syntax. When another user later views the build report, the browser parses the payload as executable JavaScript. The stored nature of the flaw means the payload persists across sessions and fires for every viewer of the affected report.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin's build report template concatenates the job name directly into a <script> block or JavaScript string literal without invoking a context-appropriate escaping routine. Escaping suitable for HTML body content does not neutralize characters such as quotes, backslashes, and angle brackets that break out of a JavaScript string.

Attack Vector

Exploitation requires an authenticated Jenkins user with Item/Create or Item/Configure permission. The attacker creates a job whose name contains a JavaScript payload, or renames an existing job. The payload activates when any user, including administrators, opens the associated build report page. Because the vulnerability crosses the security scope boundary between low-privileged job authors and higher-privileged viewers, it can lead to hijacking of administrative sessions, forged API calls under the victim's identity, and compromise of downstream build systems.

See the Jenkins Security Advisory SECURITY-3750 for vendor-provided technical details.

Detection Methods for CVE-2026-70441

Indicators of Compromise

Jenkins job names containing <script>, </script>, "+, ';, or other JavaScript-breaking sequences
Audit log entries showing job creation or rename events by non-administrator accounts followed by administrator visits to the build report page
Unexpected outbound HTTP requests from browsers of Jenkins users viewing build report pages
Anomalous session activity or API token usage originating from administrator accounts shortly after viewing a build report

Detection Strategies

Inventory installed plugins and flag any Jenkins instance running Summary Display Plugin at version 1.15 or earlier
Query Jenkins job configurations for job names containing HTML or JavaScript metacharacters such as <, >, ", ', or backticks
Correlate Content Security Policy (CSP) violation reports from browsers accessing Jenkins with build report URLs

Monitoring Recommendations

Enable and centrally collect the Jenkins audit trail for Item/Create, Item/Configure, and rename events
Monitor reverse proxy or WAF logs for Jenkins build report page requests returning payloads with script tags in job identifiers
Alert on new or modified Jenkins user accounts granted Item/Create or Item/Configure permissions

How to Mitigate CVE-2026-70441

Immediate Actions Required

Upgrade the Summary Display Plugin to a version later than 1.15 once the maintainer publishes a fix per SECURITY-3750
Audit existing job names for embedded script content and rename or delete any suspicious jobs
Review which users hold Item/Create and Item/Configure permissions and revoke access for accounts that do not require it
Rotate Jenkins API tokens and administrative session cookies if malicious job names are found

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3750 for the fixed plugin version and upgrade instructions. Apply the upgrade through the Jenkins Plugin Manager or by replacing the plugin .hpi file in $JENKINS_HOME/plugins/ and restarting the controller.

Workarounds

Disable the Summary Display Plugin until a fixed version is available and installed
Restrict Item/Create and Item/Configure permissions to trusted administrators using Matrix-based or Role-based authorization
Enforce a strict Content Security Policy on the Jenkins reverse proxy to limit inline script execution on build report pages
Require peer review of job configuration changes through Configuration as Code or Jenkinsfile-driven workflows

bash

# Configuration example: list installed plugin version and disable if vulnerable
jenkins-cli -s "$JENKINS_URL" list-plugins | grep -i summary-display
jenkins-cli -s "$JENKINS_URL" disable-plugin summary-display
# After upgrading, re-enable:
# jenkins-cli -s "$JENKINS_URL" enable-plugin summary-display