CVE-2019-10309

Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response

9.3 Critical

Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

1.79%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 9.3

Record: CVE-2019-10309
CVSS 3.0: 9.3 CriticalCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
CVSS 2.0: 4.8 MediumAV:A/AC:L/Au:N/C:P/I:N/A:P
Weakness: CWE-611
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-10309
Updated: 2026-11-02

EUVDEUVD-2022-5531 No score

Record: EUVD-2022-5531
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w898-3ph8-5pgm 6.1

Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response

Jenkins Swarm Plugin allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents.

Swarm Plugin does not configure the XML parser in a way that would prevent XML External Entity (XXE) processing. This allows unauthenticated attackers on the same network to have Swarm clients parse a maliciously crafted XML response that uses external entities to read arbitrary files from the Swarm client or denial-of-service attacks.

As of publication of this advisory, there is no fix.

Record: GHSA-w898-3ph8-5pgm
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

OSVGHSA-w898-3ph8-5pgm 6.1

Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response

Jenkins Swarm Plugin allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents.

As of publication of this advisory, there is no fix.

Record: GHSA-w898-3ph8-5pgm
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:swarm` Maven	through 3.15	None known
`org.jenkins-ci.plugins:swarm` Maven	through 3.15, plus listed versions 1.101.111.151.161.17 Show 28 moreShow less 1.181.191.201.211.221.231.241.251.261.61.71.81.92.02.12.23.103.113.123.133.143.33.43.53.63.73.83.9	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10309 is a critical vulnerability (CVSS 9.3) in Jenkins Project Self-organizing Swarm Plug-in Modules Plugin, published April 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. No source names a fixed version.