Jenkins bug bounty programs
jenkins.io Updated
Jenkins runs two public programs: a Sorona bug bounty paying up to €5,000 and a self-hosted disclosure program with no cash rewards.
- Top reward
- €5,000
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 21
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Jenkins
Sorona · Pays the most of the 2 programs: up to €5,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Jenkins
Sorona · Bug bounty |
€5,000 (highest) | – | – | – | €5,000 | Partial | – | 3 days promised | Open |
|
Jenkins
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | 3 days promised | Open |
-
- Critical
- €5,000 (highest)
- High
- –
- Medium
- –
- Low
- –
- Safe harbor
- Partial
- First response
- 3 days promised
-
- Safe harbor
- None
- First response
- 3 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
21 targets across all 2 programs, each listed once with the programs that cover it. 10 excluded.
-
Jenkins infrastructure projects, such as jenkins.io or more generally the repositories hosted in the jenkins-infra GitHub organization
Source code
Covered by Self-hosted
-
A focused set of four security-related plugins that anchor the funded bounty. Public CVEs disclosed through the program map to the Script Security plugin, the Matrix Authorization Strategy plugin, and the Credentials Binding plugin.
Products and areas
Covered by Sorona
-
Additional components published by the Jenkins project for general use, such as Docker images for Jenkins agents
Products and areas
Covered by Self-hosted
-
Authentication, authorization, and permission-check flaws that let a lower-privileged user act beyond their granted role across the permission model (Overall/Read, Item/Configure, and similar).
Products and areas
Covered by Sorona
-
Jenkins Core and its main components, including the official installers and the official Jenkins core Docker images.
Products and areas
Covered by Sorona
-
Jenkins project infrastructure, including the jenkins.io site and the jenkins-infra repositories.
Products and areas
Covered by Sorona
-
Jenkins, including installers and Docker images published by the Jenkins project
Products and areas
Covered by Self-hosted
-
Official plugins listed on plugins.jenkins.io, as part of the wider Jenkins security-reporting surface the program draws from.
Products and areas
Covered by Sorona
-
Scope may expand to further components of the Jenkins ecosystem as the program runs its roughly 12-month course from November 2025 through November 2026.
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 10
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything reachable only by a user who already holds Overall/Administer permission, including Script Console code execution, which is treated as intended functionality.
Sorona
-
CloudBees commercial products and other third-party or vendor software, which go directly to the vendor.
Sorona
-
Components and plugins outside the in-scope set, including forks and unlisted libraries.
Sorona
-
Cookies missing the Secure flag from misconfiguration, and cookies missing HttpOnly when they carry no sensitive data.
Sorona
-
Issues specific to CloudBees Jenkins products
Self-hosted
-
Issues specific to JayeX
Self-hosted
-
Plugin flaws already mitigated by a Jenkins core change shipped 13 or more months earlier, secrets appearing in logs only above INFO verbosity, and users triggering builds or SCM polling where the access-control design already permits it.
Sorona
-
Publicly accessible Jenkins controllers other than ci.jenkins.io and weekly.ci.jenkins.io
Self-hosted
-
Undemonstrated vulnerabilities in dependencies with no plausible or working exploit.
Sorona
-
Unprotected web methods that merely make Jenkins fetch a non-attacker-controlled URL without disclosing configuration or returning sensitive data.
Sorona
Recent changes
Reward and scope changes across every Jenkins program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Jenkins products, from the NVD.
-
CVE-2026-117622 Medium
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
-
CVE-2026-117622 Medium
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
-
CVE-2026-117623 Medium
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
-
CVE-2026-117624 High
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
-
CVE-2026-117623 Medium
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
-
CVE-2026-117624 High
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
-
CVE-2026-117617 High
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file syst
-
CVE-2026-117614 High
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
About this page
This page gathers every public program listed under jenkins.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.