Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 428e782a-0e92-11f1-a9b1-0cc47ada5f32 advisory.

    Jenkins Security Advisory:
    Stored XSS vulnerability in node offline cause description     Build information disclosure vulnerability through Run Parameter

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the
    user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure
    permission to obtain information about the existence of jobs, the existence of builds, and if a specified
    build exists, its display name. (CVE-2026-27100)

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.541.2 or Jenkins weekly prior to 2.551. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape     the user-provided description of the Mark temporarily offline offline cause, resulting in a stored     cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect     permission. (CVE-2026-27099)

  - Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the     user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure     permission to obtain information about the existence of jobs, the existence of builds, and if a specified     build exists, its display name. (CVE-2026-27100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299732	FreeBSD : jenkins -- multiple vulnerabilities (428e782a-0e92-11f1-a9b1-0cc47ada5f32)	Nessus	FreeBSD Local Security Checks	high
437901	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-wfhp-qgm8-5p5c)	Tenable Cloud Security	SCA Checks	medium
437901	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-wfhp-qgm8-5p5c)	Tenable Self-Hosted Container Security	SCA Checks	medium
299406	Jenkins LTS < 2.541.2 / Jenkins weekly < 2.551 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2026-27100

medium

Tenable Plugins

high

medium

medium

high