Jenkins Gradle Plugin versions up to and including 2.19.1252.v15196b_5a_6e10 contain a vulnerability where the plugin requests build scan data from URLs found in the build log regardless of the configured Develocity server URL. An attacker able to control the build log can exploit this behavior to have Jenkins connect to a malicious URL, thereby capturing the Develocity access key configured globally. This could lead to unauthorized access to sensitive build scan data.

Attackers who can inject or control the build log can cause Jenkins to connect to attacker-controlled URLs, resulting in the exposure of the Develocity access key configured in the global Jenkins configuration. This could compromise build scan data confidentiality and potentially lead to further unauthorized actions within the Jenkins environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict who can modify build logs and monitor build logs for suspicious URLs to reduce risk.