CVE-2019-16548: Jenkins Google Compute Engine

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.

Affected products

• Jenkins Google Compute Engine: before 4.2.0 (fixed in 4.2.0)

Published 2019-11-21. Last modified 2026-06-17.