Jenkins Matrix Authorization Strategy vulnerabilities

3 CVEs affecting Jenkins Matrix Authorization Strategy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-42521, published 2026-04-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21623, published 2021-03-18. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read…
CVE-2020-2226, published 2020-07-15. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
CVE-2026-42521, published 2026-04-29. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance…