Developer Tools

In Jenkins versions 2.442 through 2.554 and LTS versions 2.426.3 through 2.541.2 a high severity vulnerability CVE-2026-33002 was detected. This vulnerability allows attackers to bypass origin validation on the CLI WebSocket endpoint by exploiting DNS rebinding, due to origin checks relying on the Host or X-Forwarded-Host HTTP headers. To address this issue, users should upgrade Jenkins to versions beyond 2.554 or beyond LTS 2.541.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33002.

In Jenkins versions 2.554 and earlier, and LTS versions 2.541.2 and earlier a high severity vulnerability CVE-2026-33001 was detected. This vulnerability allows attackers with Item/Configure permissions to write arbitrary files on the filesystem by exploiting unsafe symbolic link handling during the extraction of .tar and .tar.gz archives. To address this issue, users should upgrade Jenkins to versions beyond 2.555 or beyond LTS 2.541.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33001.

In ZITADEL versions 4.0.0-rc.1 to 4.7.0 a critical severity vulnerability CVE-2026-29067 was detected. This vulnerability allows attackers to manipulate the Forwarded or X-Forwarded-Host header used in the password reset mechanism of Login V2, potentially constructing malicious password reset URLs that could lead to account takeover. To address this issue, users should upgrade ZITADEL to version 4.7.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29067.

In ZITADEL versions 4.0.0 to 4.12.0 a high severity vulnerability CVE-2026-29193 was detected. This vulnerability allows attackers to bypass login behavior and security policies in the Login V2 UI, enabling self-registration of new accounts or signing in with a password even if these options were disabled in their organization. To address this issue, users should upgrade ZITADEL to version 4.12.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29193.

In ZITADEL versions 4.0.0 to 4.11.1 a high severity vulnerability CVE-2026-29192 was detected. This vulnerability allows attackers to perform a stored cross-site scripting (XSS) attack via the Default URI Redirect in the Login V2 interface, potentially leading to account takeover. To address this issue, users should upgrade ZITADEL to version 4.12.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29192.

In ZITADEL versions 4.0.0 to 4.11.1 a critical severity vulnerability CVE-2026-29191 was detected. This vulnerability allows attackers to perform a cross-site scripting (XSS) attack in the /saml-post endpoint of the Login V2 interface, potentially enabling a 1-click account takeover. To address this issue, users should upgrade ZITADEL to version 4.12.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29191.

In @backstage/plugin-techdocs-node versions prior to 1.14.3 a high severity vulnerability CVE-2026-29186 was detected. This vulnerability allows attackers to execute arbitrary Python code by crafting a malicious mkdocs.yml file that bypasses the plugin’s allowlist for dangerous configuration keys during the TechDocs build process. To address this issue, users should upgrade @backstage/plugin-techdocs-node to version 1.14.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29186.

In @backstage/integration versions prior to 1.20.1 a low severity vulnerability CVE-2026-29185 was detected. This vulnerability allows attackers to include encoded path traversal sequences in SCM URLs, potentially causing integration functions to redirect requests to unintended SCM provider API endpoints using server-side integration credentials. To address this issue, users should upgrade @backstage/integration to version 1.20.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29185.

In @backstage/plugin-scaffolder-backend versions prior to 3.1.4 a low severity vulnerability CVE-2026-29184 was detected. This vulnerability allows a malicious scaffolder template to bypass the log redaction mechanism and exfiltrate secrets provided during task execution through event logs. To address this issue, users should upgrade @backstage/plugin-scaffolder-backend to version 3.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29184.