Jenkins Security Bulletin: Deserialization, XSS, Auth Bypass (CVE-2026-53435) Patch Guide

Jenkins Security Advisory 2026-06-10 Vulnerability Overview 1. Deserialization Vulnerability - CVE: CVE-2026-53435 - Severity: High - Description: Jenkins uses serialization and deserialization in multiple places, such as agent/controller communication (Remoting library) and loading/saving configuration and build data (using XStream). Attackers can leverage this vulnerability to execute arbitrary code or read arbitrary files. 2. Open Redirect Vulnerability - CVE: CVE-2026-53436, CVE-2026-53437 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, contain a flaw in URL validation that allows attackers to redirect to controlled domains. 3. Missing Permission Check Allows Cancellation of Queue Items - CVE: CVE-2026-53438 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, fail to enforce Item/Read permission checks, allowing attackers to cancel queue items they do not have permission to view. 4. Missing Permission Check Allows Retrieval of Limited User Profile Information - CVE: CVE-2026-53439 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, fail to enforce permission checks, allowing attackers to determine other users' time zones and enumerate view names. 5. Open Redirect Vulnerability in "Delegate to servlet container" Security Realm - CVE: CVE-2026-53440 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not ensure that the "from" parameter is safe in the "Delegate to servlet container" security realm, allowing attackers to conduct phishing attacks. 6. Stored XSS Vulnerability in Node Offline Reason Description - CVE: CVE-2026-53441 - Severity: High - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, fail to escape user-provided offline reason descriptions, allowing attackers to execute cross-site scripting attacks. 7. Plaintext Secrets Persisted and Served via the config.xml Endpoint - CVE: CVE-2026-53442 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, persist plaintext secrets on disk, allowing attackers to obtain these secrets. Affected Versions Jenkins Weekly: 2.567 and earlier Jenkins LTS: 2.555.2 and earlier Fix Jenkins Weekly: Upgrade to 2.568 Jenkins LTS: Upgrade to 2.555.3 These versions contain fixes for the aforementioned vulnerabilities. All previous versions are considered affected by these vulnerabilities unless otherwise noted. Credits Thanks to the following reporters for discovering and reporting these vulnerabilities: Takumi Katanoda (SECURITY-3711) Fushuling@secsys from Fudan University and RacerZ@secsys from Fudan University (SECURITY-3755) Takumi Katanoda and Kartik T Nair (SECURITY-3721) dqh1 (SECURITY-3707) quannn and vstxckr (SECURITY-3744) sam91281 (SECURITY-3713) sam91281 and Aries441 (SECURITY-3712) wooseokdotkim (SECURITY-3731) --- Summary The Jenkins Security Advisory 2026-06-10 covers several critical vulnerabilities, including deserialization vulnerabilities, open redirect vulnerabilities, missing permission checks, stored XSS vulnerabilities, and plaintext secret persistence. Affected versions are Jenkins Weekly 2.567 and earlier, and Jenkins LTS 2.555.2 and earlier. Users are advised to upgrade to Jenkins Weekly 2.568 or Jenkins LTS 2.555.3 as soon as possible to fix these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Deserialization, XSS, Auth Bypass (CVE-2026-53435) Patch Guide