Jenkins

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Valid critical finding (advertised ceiling) │ up to EUR 5,000 │ up to EUR 6,000 Submit a vulnerability CVE history 70 Last 12 months 1,780 Lifetime XSS 40 % Access control 22 % Injection 18 % Code execution 12 % Latest advisories Loading the feed Overview Route your report through sorona.xyz to receive 1.25x the rewards offered, plus up to $1,000 more for especially complex or well-chained bugs. Jenkins is the dominant self-hosted CI/CD automation server, extended by thousands of community plugins. Its security team maintains a hard split between hardened core and the vast, independently maintained plugin ecosystem, where most disclosed vulnerabilities actually surface. In scope Jenkins Core and its main components, including the official installers and the official Jenkins core Docker images. Jenkins agent Docker images. A focused set of four security-related plugins that anchor the funded bounty. Public CVEs disclosed through the program map to the Script Security plugin, the Matrix Authorization Strategy plugin, and the Credentials Binding plugin. Official plugins listed on plugins.jenkins.io, as part of the wider Jenkins security-reporting surface the program draws from. Jenkins project infrastructure, including the jenkins.io site and the jenkins-infra repositories. Authentication, authorization, and permission-check flaws that let a lower-privileged user act beyond their granted role across the permission model (Overall/Read, Item/Configure, and similar). Scope may expand to further components of the Jenkins ecosystem as the program runs its roughly 12-month course from November 2025 through November 2026. Out of scope Anything reachable only by a user who already holds Overall/Administer permission, including Script Console code execution, which is treated as intended functionality. CloudBees commercial products and other third-party or vendor software, which go directly to the vendor. Unprotected web methods that merely make Jenkins fetch a non-attacker-controlled URL without disclosing configuration or returning sensitive data. Undemonstrated vulnerabilities in dependencies with no plausible or working exploit. Cookies missing the Secure flag from misconfiguration, and cookies missing HttpOnly when they carry no sensitive data. Plugin flaws already mitigated by a Jenkins core change shipped 13 or more months earlier, secrets appearing in logs only above INFO verbosity, and users triggering builds or SCM polling where the access-control design already permits it. Components and plugins outside the in-scope set, including forks and unlisted libraries. Most-valued findings Remote or arbitrary code execution reachable by non-admin users, including Groovy sandbox escapes in Script Security. Path traversal enabling arbitrary file read or write on the controller or agent filesystem, as seen in the Credentials Binding advisory. Unsafe deserialization and arbitrary type instantiation, as seen in the Matrix Authorization Strategy advisory. Missing permission checks and broken access control on HTTP endpoints and web methods, as seen in the Script Security enumeration issue under Overall/Read. Privilege escalation across the Jenkins permission model, plus credential and secret disclosure. Stored and reflected XSS not already mitigated by core, CSRF, SSRF, and injection classes shown with a working exploit. Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Report privately through the SECURITY project in the Jenkins issue tracker, or email [email protected] , and mirror it to sorona.xyz for the uplift Include clear reproduction steps and a working proof of concept; unsubstantiated or theoretical claims are not treated as vulnerabilities Flag any coordinated-disclosure deadline up front so it can be aligned with the monthly release cadence Do not test against production Jenkins project infrastructure; validate against your own local instance No social engineering, physical attacks, or denial-of-service testing Only the first reporter of a given issue is eligible for a reward and advisory credit Disclosure Jenkins uses coordinated disclosure: the security team acknowledges reports within about three working days, assigns CVEs through its own CNA, and publishes a security advisory once a fix is ready or a deadline nears. Keep findings confidential until the advisory and fix are public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability