Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 970fd0ec-26f5-11f1-a9b1-0cc47ada5f32 advisory.

    Jenkins Security Advisory 2026-03-18:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the
    extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations
    on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can
    be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure
    permission, or able to control agent processes. (CVE-2026-33001)

According to its self-reported version number, the version of Jenkins plugins running on the remote web server is affected by multiple vulnerabilities:

  - Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on     the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to     the Jenkins controller file system. (CVE-2026-33003)

  - Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the     extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations     on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can     be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure     permission, or able to control agent processes. (CVE-2026-33001)

  - Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job     configuration form, increasing the potential for attackers to observe and capture them. (CVE-2026-33004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
304042	FreeBSD : jenkins -- multiple vulnerabilities (970fd0ec-26f5-11f1-a9b1-0cc47ada5f32)	Nessus	FreeBSD Local Security Checks	Local	high
439051	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-r6qv-frpc-q66c)	Tenable Cloud Security	SCA Checks	Local	high
439051	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-r6qv-frpc-q66c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
302903	Jenkins plugin Multiple Vulnerabilities (2026-03-18)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2026-33001

high

Tenable Plugins

high

high

high

high