CVE-2026-9674: Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability

May 27, 2026 (updated July 1, 2026)

Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to resume failed Multijob builds.

Multijob Plugin 669.v9d96a_d9c71b_0 requires POST requests for the affected HTTP endpoint.

References

github.com/advisories/GHSA-hj3h-r49w-34wh
nvd.nist.gov/vuln/detail/CVE-2026-9674
www.jenkins.io/security/advisory/2026-05-27/

Code Behaviors & Features

Detect and mitigate CVE-2026-9674 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →