CVE-2022-30956: Jenkins Rundeck

Medium severity, CVSS 5.4. EPSS: 73.3% chance of exploitation in the next 30 days.

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.

Affected products

• Jenkins Rundeck: up to and including 3.6.10

Published 2022-05-17. Last modified 2026-06-17.