Jenkins Security Advisory: Multiple Vulnerabilities Including RCE via Deserialization, Stored XSS, and Privilege Escalation (CVE-2026-53435-442)

Jenkins Security Advisory 2026-06-10 Vulnerability Overview 1. Deserialization Vulnerability - CVE: CVE-2026-53435 - Severity: High - Description: Jenkins uses serialization and deserialization in multiple places, such as agent/controller communication (Remoting library) and loading/saving configuration and build data (using XStream). Attackers can exploit this vulnerability to execute arbitrary code or read arbitrary files. 2. Open Redirect Vulnerability - CVE: CVE-2026-53436, CVE-2026-53437 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, have a flaw in URL validation that allows attackers to redirect to a controlled domain. 3. Missing Permission Check Allows Canceling Queue Items - CVE: CVE-2026-53438 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, fail to perform Item/Read permission checks, allowing attackers to cancel queue items they do not have permission to view. 4. Missing Permission Check Allows Retrieving Limited User Profile Information - CVE: CVE-2026-53439 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, fail to perform permission checks, allowing attackers to determine the time zones of other users and enumerate view names. 5. Open Redirect Vulnerability in "Delegate to servlet container" Security Realm - CVE: CVE-2026-53440 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe, allowing attackers to conduct phishing attacks. 6. Stored XSS Vulnerability in Node Offline Reason Description - CVE: CVE-2026-53441 - Severity: High - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not escape user-provided offline reason descriptions, leading to a stored XSS vulnerability. 7. Secrets Stored and Served in Plaintext in config.xml Endpoint - CVE: CVE-2026-53442 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, store secrets in plaintext on disk and expose these secrets in subsequent requests. Affected Versions Affected Versions: - Jenkins Weekly up to 2.567 - Jenkins LTS up to 2.555.2 Remediation Fixed Versions: - Jenkins Weekly should be updated to 2.568 - Jenkins LTS should be updated to 2.555.3 Additional Information Reporters: - Takumi Katanoda (SECURITY-3711) - Fushuling@secsys from Fudan University and RacerZ@secsys from Fudan University (SECURITY-3755) - Takumi Katanoda and Kartik T Nair (SECURITY-3721) - dqh1 (SECURITY-3707) - quannn and vstxckr (SECURITY-3744) - sam91281 (SECURITY-3713) - sam91281 and Aries441 (SECURITY-3712) - wooseokdotkim (SECURITY-3731) Sponsor: - Jenkins Bug Bounty Program sponsored by the European Commission License: - Content is based on the Creative Commons Attribution-ShareAlike 4.0 License --- Summary The Jenkins Security Advisory 2026-06-10 covers multiple severe vulnerabilities, including deserialization vulnerabilities, open redirect vulnerabilities, missing permission checks, stored XSS vulnerabilities, and secrets stored in plaintext. Affected versions are Jenkins Weekly up to 2.567 and Jenkins LTS up to 2.555.2. Users are advised to update to Jenkins Weekly 2.568 or Jenkins LTS 2.555.3 as soon as possible to patch these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple Vulnerabilities Including RCE via Deserialization, Stored XSS, and Privilege Escalation (CVE-2026-53435-442)