GHSA-6837-qgrc-x5p6
Low · 3.5CVSS
3.5
EPSS
—
Published
Dec 10, 2025
CISA due date
—
The record
Jenkins has a CSRF vulnerability on the login form
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 0 | 2.528.3 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.529 | 2.541 |
| Bitnami | jenkins | 0 | 2.528.3 |
| Chainguard | jenkins-2.528 | 0 | 2.528.3-r2 |
| maven | org.jenkins-ci.main/jenkins-core | 2.529 | 2.541 |
Related vulnerabilities
- CVE-2025-67639 Jenkins has a CSRF vulnerability on the login form Same vulnerability
- GHSA-85h6-5m3v-gx37 Jenkins has a stored XSS vulnerability in node offline cause description Also affects org.jenkins-ci.main:jenkins-core
- GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27099 Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both… Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that… Also affects org.jenkins-ci.main:jenkins-core
- GHSA-9p56-p6mw-w8qc Jenkins has a Denial of service vulnerability in HTTP-based CLI Also affects org.jenkins-ci.main:jenkins-core
- GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
- GHSA-hxjg-2jvf-h3rx Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core