Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Jenkins Project | Jenkins Gradle Plugin | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 16 Sep 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL. | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: jenkins
Published:
Updated: 2026-09-16T13:53:09.388Z
Reserved: 2026-09-15T16:29:44.795Z
Link: CVE-2026-92132
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-16T14:17:15.210
Modified: 2026-09-16T14:17:15.210
Link: CVE-2026-92132
Redhat
No data.
OpenCVE Enrichment
No data.
No weakness.