BreachPublished 11 May 2026

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack

Source SecurityWeek

Description

A malicious version of the plugin was published to the Jenkins Marketplace late last week. The post Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek .

Impact

The supply chain compromise allowed attackers to publish a malicious version of the Jenkins AST plugin, potentially exposing users who installed the compromised plugin to risks associated with malicious code execution within their CI/CD pipelines. The incident also involved unauthorized access to Checkmarx's source code repositories and data leaks. However, no confirmed exploitation in the wild has been reported. The impact is primarily on the integrity and trustworthiness of the plugin distributed via the official Jenkins Marketplace.

Defensive guidance

Users should ensure they are running version 2.0.13-829.vc72453fa_1c16 or later of the Checkmarx Jenkins AST plugin. Checkmarx has released newer patched versions, including 2.0.13-848.v76e89de8a_053, available on GitHub and the Jenkins Marketplace. Users should update to the latest version immediately to mitigate risks from the compromised plugin. Checkmarx is actively managing the remediation. No additional mitigation steps have been advised by the vendor at this time.

References

securityweek.com/checkmarx-jenkins-ast-plugin-compromised-in-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 May 2026, 09:36 UTC

References

Community reviews