CVE-2021-21676: Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, a...

Security readout for executives and security teams

This Jenkins plugin issue lets a user who can read the Jenkins instance trigger a test email to any address they choose. The source bundle does not show code execution, data theft, or active exploitation. Business impact is mainly misuse of trusted Jenkins email infrastructure, especially where read access is broad or anonymous. Exposure is limited to Jenkins controllers running requests-plugin 2.2.7 or earlier where untrusted users have Overall/Read permission, including anonymous read configurations. Treat as a low-priority but straightforward hygiene fix unless Jenkins is internet-facing or allows anonymous read access. Prioritize permission review and plugin update checks during normal Jenkins maintenance. Mitigation focus: Inventory Jenkins instances for requests-plugin installations.; Identify any deployments running requests-plugin 2.2.7 or earlier.; Check Jenkins advisory and plugin guidance for fixed or recommended versions..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.