CVE-2026-92135: Vulnerability in Jenkins Project Jenkins Coverage Plugin
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
AI Analysis
Technical Summary
The Jenkins Coverage Plugin up to version 3.3358.v9487dde48783 fails to validate the coverage results ID parameter during job configuration submissions through the REST API. This allows users with Item/Configure permission to inject a javascript: scheme URL as an identifier, resulting in a stored cross-site scripting vulnerability. This vulnerability could enable script execution in the context of the Jenkins web interface.
Potential Impact
An attacker with Item/Configure permission can exploit this vulnerability to inject malicious JavaScript code that is stored and executed in the Jenkins web interface. This could lead to unauthorized actions within the Jenkins UI, potentially impacting the integrity and confidentiality of the Jenkins environment. However, exploitation requires existing configuration permissions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Item/Configure permissions to trusted users only to reduce risk of exploitation.
CVE-2026-92135: Vulnerability in Jenkins Project Jenkins Coverage Plugin
Description
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
CVSS v3.1
Score 8.0high
Affected software
Jenkins Project
Jenkins Coverage Plugin
pkg:github/jenkinsci/coverage-pluginRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Jenkins Coverage Plugin up to version 3.3358.v9487dde48783 fails to validate the coverage results ID parameter during job configuration submissions through the REST API. This allows users with Item/Configure permission to inject a javascript: scheme URL as an identifier, resulting in a stored cross-site scripting vulnerability. This vulnerability could enable script execution in the context of the Jenkins web interface.
Potential Impact
An attacker with Item/Configure permission can exploit this vulnerability to inject malicious JavaScript code that is stored and executed in the Jenkins web interface. This could lead to unauthorized actions within the Jenkins UI, potentially impacting the integrity and confidentiality of the Jenkins environment. However, exploitation requires existing configuration permissions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Item/Configure permissions to trusted users only to reduce risk of exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jenkins
- Date Reserved
- 2026-09-15T16:29:44.795Z
- State
- PUBLISHED
Threat ID: 6aaaa17355bf5e2cf5b35d60
Added to database: 09/16/2026, 14:02:27 UTC
Last enriched: 09/16/2026, 14:17:21 UTC
Last updated: 09/17/2026, 02:03:12 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.