CVE-2026-92132: Jenkins Gradle Plugin SSRF Vulnerability

CVE-2026-92132 Overview

CVE-2026-92132 affects the Jenkins Gradle Plugin version 2.19.1252.v15196b_5a_6e10 and earlier. The plugin fetches build scan data from URLs discovered in the build log, even when administrators have configured a Develocity server URL in the global configuration. Attackers who can influence the build log content can inject a malicious build scan link. Jenkins then connects to the attacker-controlled URL and transmits the Develocity access key stored in the global configuration. This behavior enables credential exfiltration through log injection [CWE-74].

Critical Impact
Attackers able to control Jenkins build log content can capture the Develocity access key by redirecting build scan requests to an attacker-specified URL.

Affected Products

Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier
Jenkins controllers with Develocity server URL configured globally
Any Jenkins pipeline invoking Gradle builds through the affected plugin

Discovery Timeline

2026-09-16 - CVE-2026-92132 published to NVD
2026-09-16 - Jenkins Security Advisory SECURITY-4028 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92132

Vulnerability Analysis

The Jenkins Gradle Plugin integrates with Develocity to publish and retrieve build scan data. Administrators can configure a trusted Develocity server URL globally, which should serve as the sole endpoint for build scan traffic. The plugin instead parses build scan links directly from the build log output. When a build scan URL appears in log lines, the plugin issues an outbound request to that URL and attaches the configured Develocity access key. This design ignores the trusted server boundary and treats untrusted log content as authoritative.

Root Cause

The root cause is improper neutralization of data used in a downstream component [CWE-74]. The plugin trusts URL strings extracted from build log output without validating them against the configured Develocity server URL. Log content originates from build steps that can be influenced by users with permission to configure or execute builds.

Attack Vector

Exploitation requires an attacker to place a crafted build scan URL into the build log. This can be achieved by controlling build scripts, injecting output through Gradle tasks, or using any process that writes to standard output during the build. Once the malicious URL appears in the log, Jenkins connects to the attacker-controlled host and submits the Develocity access key as part of the request. The attacker captures the key from inbound HTTP traffic and can then authenticate to the real Develocity server.

No verified proof-of-concept code is available. See the Jenkins Security
Advisory SECURITY-4028 for technical details on the affected code path.

Detection Methods for CVE-2026-92132

Indicators of Compromise

Outbound HTTP or HTTPS connections from Jenkins controllers to domains other than the configured Develocity server
Build log entries containing unexpected build scan URLs pointing to external or newly registered domains
Develocity access key usage from unfamiliar source addresses in Develocity server access logs

Detection Strategies

Compare destinations of build scan HTTP requests against the configured Develocity server URL and alert on mismatches
Review Jenkins build logs for build scan URL patterns that reference hosts outside the organization's trusted domain list
Correlate Jenkins controller egress traffic with build execution windows to identify anomalous outbound connections

Monitoring Recommendations

Enable network egress logging on Jenkins controllers and forward events to a centralized analytics platform
Monitor Develocity server audit logs for authentication events originating from unexpected client IPs
Track Gradle Plugin version inventory across Jenkins instances and flag versions at or below 2.19.1252.v15196b_5a_6e10

How to Mitigate CVE-2026-92132

Immediate Actions Required

Upgrade the Jenkins Gradle Plugin to a version later than 2.19.1252.v15196b_5a_6e10 as described in Jenkins Security Advisory SECURITY-4028
Rotate the Develocity access key configured in the Jenkins global configuration to invalidate any previously exposed credential
Restrict Jenkins permissions so that only trusted users can configure jobs or influence build log output

Patch Information

Jenkins published Security Advisory SECURITY-4028 on 2026-09-16 addressing this issue. Refer to the Jenkins Security Advisory SECURITY-4028 for the fixed plugin version and remediation guidance.

Workarounds

Remove the globally configured Develocity access key until the plugin is upgraded
Restrict Jenkins controller network egress to only the configured Develocity server host
Limit build execution and job configuration permissions to reduce the pool of users capable of injecting log content

bash

# Verify installed Jenkins Gradle Plugin version
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="gradle") | {shortName, version}'