CVE-2021-21678: Jenkins SAML

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

Affected products

• Jenkins SAML: from 1.1.3, up to and including 2.0.7

Published 2021-08-31. Last modified 2026-06-17.