Jenkins Security Bulletin: CVEs for RCE, XSS, IDOR, and Secret Leakage

Jenkins Security Advisory 2026-06-10 Vulnerability Overview 1. Deserialization Vulnerability - CVE: CVE-2026-53435 - Severity: High - Description: Jenkins uses serialization and deserialization in multiple places, such as agent/controller communication (Remoting library) and loading/saving configuration and build data (using XStream). Attackers can exploit this vulnerability to execute arbitrary code or read arbitrary files. 2. Open Redirect Vulnerabilities - CVE: CVE-2026-53436, CVE-2026-53437 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, have a flaw in URL validation that allows attackers to redirect to a controlled domain. 3. Missing Permission Check Allowing Cancellation of Queue Items - CVE: CVE-2026-53438 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not perform an Item/Read permission check, allowing attackers to cancel queue items they do not have permission to view. 4. Missing Permission Check Allowing Retrieval of Limited User Profile Information - CVE: CVE-2026-53439 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not perform permission checks, allowing attackers to determine other users' time zones and enumerate view names. 5. Open Redirect Vulnerability in the "Delegate to Servlet Container" Security Realm - CVE: CVE-2026-53440 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not ensure that the "from" parameter is safe in the "Delegate to Servlet Container" security realm, allowing attackers to perform phishing attacks. 6. Stored XSS Vulnerability in Node Offline Reason Descriptions - CVE: CVE-2026-53441 - Severity: High - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, do not escape user-provided offline reason descriptions, allowing attackers to execute cross-site scripting attacks. 7. Secrets Stored and Provided in Plaintext in the config.xml Endpoint - CVE: CVE-2026-53442 - Severity: Medium - Description: Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, store secrets in plaintext on disk and expose these secrets in subsequent responses. Affected Versions Jenkins weekly: 2.567 and earlier Jenkins LTS: 2.555.2 and earlier Remediation Jenkins weekly: Upgrade to 2.568 Jenkins LTS: Upgrade to 2.555.3 Additional Information These vulnerabilities were reported through the Jenkins Bug Bounty Program and sponsored by the European Commission. Some vulnerabilities resulted from incomplete fixes. In Jenkins 2.539 and later, and LTS 2.541.1 and later, a Content Security Policy (CSP) is enforced to mitigate stored XSS vulnerabilities. Summary This security advisory details multiple vulnerabilities in Jenkins, including deserialization vulnerabilities, open redirect vulnerabilities, missing permission check vulnerabilities, stored XSS vulnerabilities, and vulnerabilities involving plaintext storage of secrets. Affected versions are Jenkins weekly 2.567 and earlier, and Jenkins LTS 2.555.2 and earlier. Users are advised to upgrade to Jenkins weekly 2.568 or Jenkins LTS 2.555.3 as soon as possible to remediate these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: CVEs for RCE, XSS, IDOR, and Secret Leakage