When a Jenkins plugin has a vulnerability and its maintainer will not or cannot fix it, the Jenkins security team publishes an advisory saying there is no fix. In severe cases it also suspends distribution of the plugin on the update sites. Your job is to decide whether to keep using it.
How the process works
The Jenkins project describes a fixed sequence. The security team contacts the plugin maintainers first. If they decline, do not respond in time, and the team has no capacity to fix the issue itself, it moves to the next steps.
| Step | What happens |
|---|---|
| 1 | The team publishes an advisory that describes the issue and states that no fix exists, apart from no longer using the plugin. |
| 2 | Any workaround is explained in the advisory. |
| 3 | For particularly severe cases, distribution of the plugin is suspended on the Jenkins update sites. |
A later fix does not rewrite the original advisory. It stays accurate as of the day it was published, so always check the plugin page for the current status.
What a suspended plugin means for you
Suspension is used when a plugin has severe vulnerabilities, deliberately bypasses or disables protection mechanisms, or offers little benefit to users. Plugins that need a suspended plugin to run are suspended too, because they could no longer be installed.
Suspension does not remove the plugin from your controller. An instance that already has it keeps running it. That is why the warning side matters.
How Jenkins warns administrators
Warnings reach you in several places: the advisory itself, warning metadata that shows vulnerable plugins inside the plugin manager, and active warnings on the plugins site. When a fix is confirmed, the team updates the metadata and the warning goes away.
A practical decision process
- Open Manage Jenkins, then Plugins, and read the warnings shown against installed plugins.
- For each warned plugin, open the advisory and read its stated status and any workaround.
- Check whether the plugin, or anything that depends on it, has been suspended.
- Decide: apply the workaround, replace the feature with another approach, or stop using the plugin.
- Record the decision and the date, with the advisory link, so the next reviewer knows why it stayed or went.
If you keep a plugin with an open advisory, reduce exposure. Limit who can reach the feature, keep the controller off the public internet, and avoid running builds on the built-in node.
Try it yourself
Open the demo and look at how a vulnerability list changes once findings are ranked and tracked over time.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard does SBOM and dependency scanning and lets you set policies and gates on findings, which helps keep a record of what is installed and what is open. You can try a free scan.
Quick check
Does suspending a plugin remove it from my controller?
No. Suspension stops distribution on the update sites. A controller that already has the plugin still runs it, so you must act on the advisory yourself.
Does a later fix change the original advisory?
No. The advisory remains accurate as of its publication date. Check the plugin page for the current state.
Sources
Last reviewed: 19 October 2026.
