Stored Cross-Site Scripting Vulnerability in Jenkins Summary Display Plugin
CVE-2026-70441

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins Summary Display Plugin
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70441?

The Jenkins Summary Display Plugin versions 1.15 and earlier are vulnerable to a stored cross-site scripting (XSS) issue. This vulnerability arises from the failure to properly escape job names in the JavaScript context on build report pages. Attackers with Item/Create or Item/Configure permissions can exploit this flaw to inject malicious scripts, potentially leading to unauthorized actions or data theft.

Affected Version(s)

Jenkins Summary Display Plugin 0 <= 1.15

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.