Cross-site request forgery in Jenkins SAML Plugin
Priority MEDIUM 40CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-693.
Summary
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
Why it matters now
EPSS 0.0081 57th percentileScored 2026-11-07
Fix Fixed Jenkins SAML Plugin (Jenkins project): 1.1.8, 2.0.3.1org.jenkins-ci.plugins:saml (Maven): 2.0.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins SAML Plugin | 1.1.3 and later; up to 2.0.7 | 1.1.8, 2.0.3.1 | Patch available | CNA |
| — | org.jenkins-ci.plugins:saml (Maven) | before 2.0.8 | 2.0.8 | Patch available | GHSA-r5w3-pfq8-3r82 |
- Jenkins SAML Plugin VendorJenkins Affected 1.1.3 and later; up to 2.0.7 Fixed in 1.1.8, 2.0.3.1 Patch available CNA
- org.jenkins-ci.plugins:saml (Maven) Vendor— Affected before 2.0.8 Fixed in 2.0.8 Patch available GHSA-r5w3-pfq8-3r82
Remediation
- Fix · CNA Jenkins SAML Plugin (Jenkins project) Fixed in 1.1.8, 2.0.3.1
- Fix · GHSA-r5w3-pfq8-3r82 org.jenkins-ci.plugins:saml (Maven) Fixed in 2.0.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21678
- 2026-10-03 Alias added: GHSA-r5w3-pfq8-3r82
References
Advisory 3
More Jenkins Saml vulnerabilities
- TI-2025-39582 Authentication bypass by capture-replay in Jenkins SAML Plugin CVSS 3.1HIGH 7.5
- TI-2018-15957 A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in… CVSS 3.0MEDIUM 5.9
Sources
- CVE-2021-21678 · CVE Program
- CVE-2021-21678 · NVD
- FIRST EPSS
- GHSA-r5w3-pfq8-3r82 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences