CVE-2026-92135 — Jenkins Project / Jenkins Coverage Plugin

CVE-2026-92135

Jenkins Project / Jenkins Coverage Plugin PUBLISHED

Description (CNA)

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins Coverage Plugin	unaffected 3.3325.3327.v26c59e218691; unaffected 3.3361.v0626103a_67e6 before *

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-4118

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.