A Jenkins plugin with CRITICAL severity CVE is installed on a Jenkins Instance

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_350
Category - Subcategory	Pipeline Configuration - 3rd Party Services
Severity	CRITICAL

Impact

A Jenkins plugin with a CRITICAL severity CVE is used in a Jenkins Instance. Using such plugin is a tier-one security risk. Because Jenkins often serves as the "keys to the kingdom"—holding credentials for production servers, cloud environments, and proprietary source code—a single vulnerable plugin can compromise your entire organization.