CVE-2026-92132 — MEDIUM (5.4)

Vulnerability Description

Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-74

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-4028

FAQ

What is CVE-2026-92132?

CVE-2026-92132 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global c...

How severe is CVE-2026-92132?

CVE-2026-92132 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-92132?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.