Jenkins Security Bulletin: RCE, XSS, Auth Bypass & Multiple CVEs (2026-06-10)

Jenkins Security Advisory 2026-06-10 Vulnerability Overview 1. Deserialization Vulnerability - Security ID: SECURITY-3707 / CVE-2026-53435 - Severity: High - Description: Jenkins uses serialization and deserialization in various places, such as agent/controller communication (via the Remoting library) and loading persisted configuration and build data (using XStream). Attackers can exploit this to deserialize arbitrary types defined in Jenkins core or plugins via attacker-controlled submissions, thereby executing arbitrary code. 2. Open Redirect Vulnerability - Security ID: SECURITY-3711+3755 / CVE-2026-53436 (leading period), CVE-2026-53437 (tab or newline character) - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier contain a flaw in verifying whether a URL is safe for redirection to the default login flow. Attackers can exploit this vulnerability to redirect users to a domain controlled by the attacker. 3. Missing Authorization Check Allowing Cancellation of Queued Items - Security ID: SECURITY-3712 / CVE-2026-53438 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier fail to perform Item/Read permission checks on HTTP endpoints. Attackers can exploit this vulnerability to cancel queue items they do not have permission to view. 4. Missing Authorization Check Allowing Retrieval of Limited User Profile Information - Security ID: SECURITY-3713 / CVE-2026-53439 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier fail to perform authorization checks on HTTP endpoints. Attackers can exploit this vulnerability to determine other users' configured time zones and enumerate the view names of other users' "My Views." 5. Open Redirect Vulnerability in "Delegate to Servlet Container" Security Realm - Security ID: SECURITY-3721 / CVE-2026-53440 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier do not ensure that the "from" parameter in the "Delegate to Servlet Container" security realm redirects to a safe realm after login. Attackers can exploit this vulnerability to perform phishing attacks. 6. Stored XSS Vulnerability in Node Offline Reason Description - Security ID: SECURITY-3731 / CVE-2026-53441 - Severity: High - Description: Since Jenkins 2.483, the node offline reason description ("Offline Reason") is defined to contain HTML and is rendered. Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier fail to escape user-provided general offline reason descriptions, leading to a stored Cross-Site Scripting (XSS) vulnerability. 7. Plaintext Storage and Exposure of Secrets in the config.xml Endpoint - Security ID: SECURITY-3744 / CVE-2026-53442 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier write submissions to disk until their content can be successfully deserialized. The response serves content from these files, resulting in plaintext secrets persisting on disk and reappearing in subsequent responses, exposing them to users with Item/Extended Read permission. Affected Versions Affected Versions: - Jenkins weekly up to and including 2.567 - Jenkins LTS up to and including 2.555.2 Resolution Fixed Versions: - Jenkins weekly should be updated to 2.568 - Jenkins LTS should be updated to 2.555.3 These versions include fixes for the aforementioned vulnerabilities. All prior versions are considered affected by these vulnerabilities unless otherwise stated. Additional Information Reporters: - Takumi Katanoda (SECURITY-3711) - Fushuling@secsys from Fudan University and RacerZ@secsys from Fudan University (SECURITY-3755) - Michael Blunt (SECURITY-3755) - Takumi Katanoda, and, independently, Kartik T Nair (@k0wd4lz1) (SECURITY-3721) - dqh1 (SECURITY-3707) - quannn and vstxckr (SECURITY-3744) - sam91281 (SECURITY-3713) - sam91281; and, independently, Aries441 (SECURITY-3712) - wooseokdotkim (SECURITY-3731) Support: - These vulnerabilities were reported through the Jenkins Bug Bounty Program, sponsored by the European Commission. Resources: - Improve this page - Report page issues - Resources, projects, community, and other links Copyright: - 2026 CD Foundation The Linux Foundation®. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. Linux is a registered trademark of Linus Torvalds. Privacy Policy and Terms of Use.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: RCE, XSS, Auth Bypass & Multiple CVEs (2026-06-10)