Gradle vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-25063 gradle-completion provides Bash and Zsh completion support for Gradle.High 8.3 · Jan 29, 2026
• CVE-2026-22865 Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.High 8.6 · Jan 16, 2026
• CVE-2026-22816 Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.High 8.6 · Jan 16, 2026
• CVE-2025-27148 Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.High 8.8 · Feb 25, 2025
• CVE-2024-46881 Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control.High 7.1 · Jan 26, 2025
• CVE-2025-24858 Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the syHigh 8.3 · Jan 26, 2025
• CVE-2023-49238 In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-uniqCritical 9.8 · Jan 8, 2024
• CVE-2023-30853 Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow.High 7.6 · Apr 28, 2023
• CVE-2022-41575 A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of aHigh 7.5 · Oct 21, 2022
• CVE-2022-41574 An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbHigh 7.5 · Oct 7, 2022
• CVE-2022-30587 Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.High 7.5 · Jun 6, 2022
• CVE-2022-30586 Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.High 7.2 · Jun 6, 2022
• CVE-2022-27919 Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file.Critical 9.8 · Mar 25, 2022
• CVE-2022-25364 In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access.High 8.1 · Mar 17, 2022
• CVE-2022-23630 Gradle is a build tool with a focus on build automation and support for multi-language development.High 7.5 · Feb 10, 2022
• CVE-2021-41619 An issue was discovered in Gradle Enterprise before 2021.1.2.High 7.2 · Oct 27, 2021
• CVE-2021-41589 In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the Critical 9.8 · Oct 27, 2021
• CVE-2021-41588 In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects.High 8.1 · Sep 24, 2021
• CVE-2021-41587 In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.High 7.5 · Sep 24, 2021
• CVE-2021-41586 In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.High 7.5 · Sep 24, 2021
• CVE-2021-41584 Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a High 7.5 · Sep 23, 2021
• CVE-2021-32751 Gradle is a build tool with a focus on build automation.High 7.5 · Jul 20, 2021
• CVE-2021-29428 In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and High 8.8 · Apr 13, 2021
• CVE-2021-29427 In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning.High 8 · Apr 13, 2021
• CVE-2020-15776 An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4.High 8.8 · Sep 18, 2020