Jenkins Security Advisory: Deserialization RCE, Stored XSS, and Permission Bypass CVEs

Jenkins Security Advisory 2026-06-10 Vulnerability Summary 1. Deserialization Vulnerability - CVE: CVE-2026-53435 - Severity: High - Description: Jenkins uses serialization and deserialization in multiple areas, such as agent/controller communication (Remoting library) and loading/saving configuration and build data (using XStream). Attackers can exploit this vulnerability to execute arbitrary code or read arbitrary files. 2. Open Redirect Vulnerabilities - CVE: CVE-2026-53436, CVE-2026-53437 - Severity: Medium - Description: Jenkins 2.567 and earlier versions, LTS 2.555.2 and earlier versions, have flaws in URL validation that allow attackers to redirect to controlled domains. 3. Missing Permission Check Allowing Queue Item Cancellation - CVE: CVE-2026-53438 - Severity: Medium - Description: Jenkins 2.567 and earlier versions, LTS 2.555.2 and earlier versions, have flaws in the execution of Item/Read permission checks, allowing attackers to cancel queue items they do not have permission to view. 4. Missing Permission Check Allowing Retrieval of Limited User Profile Information - CVE: CVE-2026-53439 - Severity: Medium - Description: Jenkins 2.567 and earlier versions, LTS 2.555.2 and earlier versions, lack permission checks in HTTP endpoints, allowing attackers to determine other users' time zones and enumerate view names. 5. Open Redirect Vulnerability in the "Delegate to Servlet Container" Security Realm - CVE: CVE-2026-53440 - Severity: Medium - Description: Jenkins 2.567 and earlier versions, LTS 2.555.2 and earlier versions, do not secure the "from" parameter in the "Delegate to Servlet Container" security realm, allowing attackers to perform phishing attacks. 6. Stored XSS Vulnerability in Node Offline Reason Description - CVE: CVE-2026-53441 - Severity: High - Description: Jenkins 2.567 and earlier versions, LTS 2.555.2 and earlier versions, fail to escape user-provided offline reason descriptions, resulting in a stored XSS vulnerability. 7. Secrets Saved and Served in Plaintext in the config.xml Endpoint - CVE: CVE-2026-53442 - Severity: Medium - Description: Jenkins 2.567 and earlier versions, LTS 2.555.2 and earlier versions, do not encrypt secrets when POSTing to the config.xml submission, resulting in secrets being saved and served in plaintext. Affected Versions Jenkins weekly: 2.567 and earlier versions Jenkins LTS: 2.555.2 and earlier versions Remediation Jenkins weekly: Upgrade to 2.568 Jenkins LTS: Upgrade to 2.555.3 These versions contain fixes for the vulnerabilities described above. All prior versions are considered affected by these vulnerabilities unless otherwise noted. Additional Information The vulnerabilities were reported through the Jenkins Bug Bounty Program, sponsored by the European Commission. In Jenkins 2.539 and later versions, and LTS 2.541.1 and later versions, the enforcement of Content Security Policy (CSP) can mitigate the stored XSS vulnerability. --- Summary The Jenkins 2026-06-10 Security Advisory addresses multiple high and medium severity vulnerabilities, including deserialization vulnerabilities, open redirect vulnerabilities, missing permission checks, stored XSS vulnerabilities, and plaintext secret storage issues. Affected versions are Jenkins weekly 2.567 and earlier, and Jenkins LTS 2.555.2 and earlier. Users are advised to upgrade to Jenkins weekly 2.568 or Jenkins LTS 2.555.3 as soon as possible to fix these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Deserialization RCE, Stored XSS, and Permission Bypass CVEs