Jenkins Security Bulletin: Multiple RCE and Privilege Escalation Vulnerabilities

Jenkins Security Advisory 2026-08-05 Vulnerability Overview 1. Agent-to-controller deserialization filter bypass - CVE: CVE-2026-70426 - Severity: Critical - Description: Jenkins uses the Remoting library for communication between the controller and agents. In Jenkins 2.575 and earlier, the JEP-200 class filter was not applied to classes resolved via the fallback path, allowing attackers to bypass the JEP-200 deserialization filter and execute code on the controller. 2. Link-following vulnerability allowing arbitrary file creation - CVE: CVE-2026-70427 - Severity: High - Description: Jenkins 2.575 and earlier versions failed to handle symbolic links effectively, allowing attackers with Item/Configure and Item/Build permissions to write files to arbitrary locations, potentially leading to code execution. 3. Path traversal vulnerability in file parameters - CVE: CVE-2026-70428 - Severity: High - Description: Jenkins 2.575 and earlier versions incorrectly identified file paths, allowing attackers with Item/Configure and Item/Build permissions to write files to arbitrary locations, potentially leading to code execution. 4. Improper case-sensitivity handling leading to privilege escalation - CVE: CVE-2026-70429 - Severity: High - Description: Jenkins 2.575 and earlier versions had case-insensitivity issues when handling usernames and group names, allowing attackers to create new users or groups similar to existing ones, thereby gaining privileges. 5. Users with Overall/Manage permissions can instantiate any type of configuration - CVE: CVE-2026-70430 - Severity: Low - Description: Jenkins 2.575 and earlier versions did not restrict the types of objects that could be instantiated, allowing users with Overall/Manage permissions to instantiate arbitrary configuration objects. 6. Arbitrary code execution vulnerability in the Multijob plugin - CVE: CVE-2026-70431 - Severity: High - Description: Multijob plugin versions 669.9d996a_d9c71b_0 and earlier provide Groovy script functionality, allowing users with Item/Create or Item/Configure permissions to execute arbitrary code. 7. CSRF vulnerability in the Multijob plugin allowing arbitrary code execution - CVE: CVE-2026-70432 - Severity: High - Description: Multijob plugin versions 669.9d996a_d9c71b_0 and earlier do not validate POST requests to form verification endpoints, allowing attackers to execute arbitrary code via cross-site request forgery (CSRF). 8. Missing permission check in the HCL AppScan plugin allowing enumeration of credential IDs - CVE: CVE-2026-70433 - Severity: Medium - Description: HCL AppScan plugin versions 1.8.3 and earlier do not perform permission checks, allowing users with Overall/Read permissions to enumerate credential IDs. 9. CSRF vulnerability and missing permission check in the SCM-Manager plugin - CVE: CVE-2026-70434 (CSRF), CVE-2026-70435 (Permission Check) - Severity: Medium - Description: SCM-Manager plugin versions 1.11.1 and earlier do not perform permission checks, allowing users with Overall/Read permissions to connect to attacker-specified HTTP URLs and capture credentials. 10. Missing permission check in the External Workspace Manager plugin allowing reading of workspace files - CVE: CVE-2026-70436 - Severity: Medium - Description: External Workspace Manager plugin versions 1.4.1 and earlier do not perform permission checks, allowing users with Overall/Read permissions to read workspace files. 11. Non-constant-time webhook bearer token comparison in the Webhook Secret Credentials Provider plugin - CVE: CVE-2026-70437 - Severity: Low - Description: Webhook Secret Credentials Provider plugin versions 16.v0cf_a0215cf5 and earlier do not use constant-time comparison functions, allowing attackers to obtain valid webhook bearer tokens via statistical methods. 12. Missing permission check in the Parameterized Remote Trigger plugin allowing enumeration of credential IDs - CVE: CVE-2026-70438 - Severity: Medium - Description: Parameterized Remote Trigger plugin versions 3.2.2 and earlier do not perform permission checks, allowing users with Overall/Read permissions to enumerate credential IDs. 13. Missing permission check in the XML Job to Job DSL plugin - CVE: CVE-2026-70439 - Severity: Medium - Description: XML Job to Job DSL plugin versions 0.1.13 and earlier do not perform permission checks, allowing any user to call the conversion function and replace previously generated output. 14. Stored XSS vulnerability in the Qualys Container Scanning Connector plugin - CVE: CVE-2026-70440 - Severity: High - Description: Qualys Container Scanning Connector plugin versions 1.8.0.5 and earlier do not escape user-controlled field values, allowing attackers with Item/Configure permissions to execute stored cross-site scripting (XSS). 15. Stored XSS vulnerability in the Summary Display plugin - CVE: CVE-2026-70441 - Severity: High - Description: Summary Display plugin versions 1.15 and earlier do not escape job names, allowing attackers with Item/

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Multiple RCE and Privilege Escalation Vulnerabilities