CVE-2026-92132

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-18
Weakness: CWE-74

Description

Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.

Affected products

Jenkins Project Jenkins Gradle Plugin: through 2.19.1252.v15196b_5a_6e10

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-4028

Get alerted when CVE-2026-92132 or the next vulnerability affects your stack