Jenkins Advisory: RCE via Deserialization Bypass, Path Traversal, and Privilege Escalation

Jenkins Security Advisory 2026-08-05 Vulnerability Summary Vulnerability Overview 1. Agent-to-controller deserialization filter bypass - CVE: CVE-2026-70426 - CVSS: Critical - Description: Jenkins uses the Remoting library for communication between the controller and agents. In Jenkins 2.575 and earlier, the JEP-200 class filter was not applied to classes resolved via the fallback path. This allows attackers to bypass the JEP-200 deserialization filter and execute code on the controller. - Affected Versions: Jenkins 2.575 and earlier; LTS 2.568.1 and earlier. - Fix: Jenkins 2.576 and LTS 2.568.2 apply the class filter to the fallback code path. 2. Link following vulnerability allows arbitrary file creation - CVE: CVE-2026-70427 - CVSS: High - Description: Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, did not handle symbolic links securely. This allowed attackers to write files to arbitrary locations on the controller's file system by creating and archives containing symbolic links. - Affected Versions: Jenkins 2.575 and earlier; LTS 2.568.1 and earlier. - Fix: Jenkins 2.576 and LTS 2.568.2 reject and archives containing valid symbolic links with empty names during extraction. 3. Path traversal vulnerability in file parameters - CVE: CVE-2026-70428 - CVSS: High - Description: Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, incorrectly identified file paths. This allowed attackers to write files to arbitrary locations on the controller's file system via path traversal in file parameter names. - Affected Versions: Jenkins 2.575 and earlier; LTS 2.568.1 and earlier. - Fix: Jenkins 2.576 and LTS 2.568.2 improved the identification and prevention of path traversal in file parameter names. 4. Improper handling of case sensitivity allows privilege escalation - CVE: CVE-2026-70429 - CVSS: High - Description: Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, handled user and group names inconsistently. This allowed attackers to create new users or groups that matched existing user or group names in a case-insensitive manner. - Affected Versions: Jenkins 2.575 and earlier; LTS 2.568.1 and earlier. - Fix: Jenkins 2.576 and LTS 2.568.2 compare user and group names using their canonical forms. 5. Users with Overall/Manage permission can instantiate any types related to configuration - CVE: CVE-2026-70430 - CVSS: Low - Description: Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, did not restrict the types of objects that could be instantiated. This allowed attackers with Overall/Manage permissions to instantiate arbitrary configuration object types. - Affected Versions: Jenkins 2.575 and earlier; LTS 2.568.1 and earlier. - Fix: Jenkins 2.576 and LTS 2.568.2 restricted the types of objects that can be instantiated. 6. Arbitrary code execution vulnerability in Multijob Plugin - CVE: CVE-2026-70431 - CVSS: High - Description: Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier provide Groovy script functionality that is not integrated with the Script Security Plugin. This allows attackers to execute arbitrary code. - Affected Versions: Multijob Plugin 669.v9d96a_d9c71b_0 and earlier. - Fix: Multijob Plugin 677.v7ffc23d6a_4c2 integrates with the Script Security Plugin. 7. CSRF vulnerability in Multijob Plugin allows arbitrary code execution - CVE: CVE-2026-70432 - CVSS: High - Description: Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier did not require POST requests for form validation endpoints, leading to a Cross-Site Request Forgery (CSRF) vulnerability. - Affected Versions: Multijob Plugin 669.v9d96a_d9c71b_0 and earlier. - Fix: Multijob Plugin 677.v7ffc23d6a_4c2 requires POST requests for the affected form validation endpoints. 8. Missing permission checks in HCL AppScan Plugin allow enumerating credentials IDs - CVE: CVE-2026-70433 - CVSS: Medium - Description: HCL AppScan Plugin versions 1.8.3 and earlier did not perform permission checks on multiple HTTP endpoints, allowing attackers to enumerate credential IDs. - Affected Versions: HCL AppScan Plugin 1.8.3 and earlier. - Fix: HCL AppScan Plugin 1.8.4 requires appropriate permission checks on the affected HTTP endpoints. 9. CSRF vulnerability and missing permission checks in SCM-Manager Plugin - CVE: CVE-2026-70434 (CSRF), CVE-2026-70435 (permission check) - CVSS: Medium - Description: SCM-Manager Plugin versions 1.11.1 and earlier did not perform permission checks on multiple HTTP endpoints. This allowed attackers to use attacker-specified HTTP URLs to connect and capture credentials. - Affected Versions: SCM-Manager Plugin 1.11.1 and earlier. - Fix: SCM-Manager Plugin 1.12.1 requires POST requests and permission for the affected endpoints. 10. Missing permission check in External Workspace Manager Plugin allows reading workspace files - CVE: CVE-2026-70436 - CVSS: Medium - Description: External Workspace Manager Plugin versions 1.4.1 and earlier did not perform permission checks, allowing attackers to read workspace file

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Advisory: RCE via Deserialization Bypass, Path Traversal, and Privilege Escalation