Jenkins Security Advisory: Multiple CVEs including Deserialization Bypass, Path Traversal, and RCE

Jenkins Security Advisory 2026-08-05 Vulnerability Overview 1. Agent-to-controller deserialization filter bypass - CVE: CVE-2026-70426 - Severity: Critical - Description: Jenkins uses the Remoting library for communication between controllers and agents. In Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, JEP-200 class filters were not applied to classes resolved via the fallback path, allowing attackers to bypass the JEP-200 deserialization filter. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier - Remediation: Jenkins 2.576, LTS 2.568.2 apply class filters in the fallback code path. 2. Symlink following vulnerability allowing arbitrary file creation - CVE: CVE-2026-70427 - Severity: High - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier did not handle symbolic links securely, allowing attackers to write files to arbitrary locations using and permissions. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier - Remediation: Jenkins 2.576, LTS 2.568.2 reject and archives containing symlinks with valid empty names during extraction. 3. Path traversal vulnerability in File parameters - CVE: CVE-2026-70428 - Severity: High - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier incorrectly identified file paths, allowing attackers to write files to arbitrary locations using and permissions. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier - Remediation: Jenkins 2.576, LTS 2.568.2 improved detection of file parameters attempting path traversal. 4. Improper case sensitivity handling leading to privilege escalation - CVE: CVE-2026-70429 - Severity: High - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier exhibited inconsistency in username and group name handling, allowing attackers to create new users or groups that matched existing user or group names in a case-insensitive manner. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier - Remediation: Jenkins 2.576, LTS 2.568.2 compare usernames and group names using their canonical forms. 5. Users with Overall/Manage permission can instantiate any configuration type - CVE: CVE-2026-70430 - Severity: Low - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier did not restrict the types of objects that could be instantiated, allowing attackers to instantiate arbitrary configuration types. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier - Remediation: Jenkins 2.576, LTS 2.568.2 restrict the types of objects that can be instantiated. 6. Arbitrary code execution vulnerability in the Multijob plugin - CVE: CVE-2026-70431 - Severity: High - Description: Multijob plugin 669.v9d96a_d9c71b_0 and earlier versions provide Groovy script functionality that is not integrated with the Script Security plugin, allowing attackers to execute arbitrary code. - Affected Versions: Multijob plugin 669.v9d96a_d9c71b_0 and earlier - Remediation: Multijob plugin 677.v7ffc23d6a_4c2 integrates the Script Security plugin to enforce a sandbox for Groovy scripts. 7. CSRF vulnerability in the Multijob plugin allowing arbitrary code execution - CVE: CVE-2026-70432 - Severity: High - Description: Multijob plugin 669.v9d96a_d9c71b_0 and earlier versions did not require POST requests for form validation endpoints, leading to a Cross-Site Request Forgery (CSRF) vulnerability. - Affected Versions: Multijob plugin 669.v9d96a_d9c71b_0 and earlier - Remediation: Multijob plugin 677.v7ffc23d6a_4c2 requires POST requests for the affected form validation endpoints. 8. Missing permission check in the HCL AppScan plugin allowing credential ID enumeration - CVE: CVE-2026-70433 - Severity: Medium - Description: HCL AppScan plugin 1.8.3 and earlier versions did not perform permission checks on multiple HTTP endpoints, allowing attackers to enumerate credential IDs. - Affected Versions: HCL AppScan plugin 1.8.3 and earlier - Remediation: HCL AppScan plugin 1.8.4 requires appropriate permission checks on the affected HTTP endpoints. 9. CSRF vulnerability and missing permission check in the SCM-Manager plugin - CVE: CVE-2026-70434 (CSRF), CVE-2026-70435 (Permission Check) - Severity: Medium - Description: SCM-Manager plugin 1.11.1 and earlier versions did not perform permission checks on multiple HTTP endpoints, allowing attackers to connect using attacker-specified HTTP URLs and capture credentials. - Affected Versions: SCM-Manager plugin 1.11.1 and earlier - Remediation: SCM-Manager plugin 1.12.1 requires POST requests and permissions for the affected endpoints. 10. Missing permission check in the External Workspace Manager plugin allowing workspace file reading - CVE: CVE-2026-70436 - Severity: Medium - Description: External Workspace Manager plugin 1.4.1 and earlier versions did not perform permission checks, allowing attackers to read unauthorized workspace files. - Affected Versions: External Workspace Manager plugin 1.4.1 and earlier - Remediation: Exte

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple CVEs including Deserialization Bypass, Path Traversal, and RCE