Jenkins Security Bulletin: Multiple Vulnerabilities Including RCE, Privilege Escalation, and Path Traversal in Core and Plugins

The following is a summary of key vulnerability information based on the provided webpage screenshot: --- Jenkins Security Bulletin 2026-08-05 Vulnerability Overview This bulletin addresses security vulnerabilities in multiple Jenkins components, including deserialization, file creation, path traversal, privilege escalation, arbitrary code execution, CSRF, credential enumeration, and stored XSS. --- Affected Versions Jenkins Core: Versions 2.575 and earlier, LTS 2.568.1 and earlier. Plugins: - AWS CodeBuild Plugin - CodeSonar Plugin - External Workspace Manager Plugin - Google Chat Notification Plugin - HCL AppScan Plugin - Horreum Plugin - Ivy Report Plugin - Multijob Plugin - Parameterized Remote Trigger Plugin - Qualys Container Scanning Connector Plugin - Sauce OnDemand Plugin - SCM-Manager Plugin - Summary Display Plugin - Violation Comments to GitLab Plugin - Webhook Secret Credentials Provider Plugin - XML Job to Job DSL Plugin --- Remediation Jenkins Core: Upgrade to 2.576 or LTS 2.568.2. Plugins: - Multijob Plugin: Upgrade to 677.v7ffc23d6a_4c2. - HCL AppScan Plugin: Upgrade to 1.8.4. - SCM-Manager Plugin: Upgrade to 1.12.1. - External Workspace Manager Plugin: Upgrade to 1.4.2. - Webhook Secret Credentials Provider Plugin: Upgrade to 32.v09cb_522f0a_8. - Parameterized Remote Trigger Plugin: No fix available. - XML Job to Job DSL Plugin: No fix available. - Qualys Container Scanning Connector Plugin: No fix available. - Summary Display Plugin: No fix available. - Google Chat Notification Plugin: No fix available. --- Vulnerability Details 1. Agent-to-controller deserialization filter bypass CVE: CVE-2026-70426 CVSS: Critical Description: Jenkins uses the Remoting library for communication between controllers and agents but fails to correctly apply the JEP-200 deserialization filter, allowing attackers to bypass the filter and execute code. Fix: Upgrade to 2.576 or LTS 2.568.2. 2. Link following vulnerability allows arbitrary file creation CVE: CVE-2026-70427 CVSS: High Description: Jenkins does not properly handle symbolic links, allowing attackers to create arbitrary files. Fix: Upgrade to 2.576 or LTS 2.568.2. 3. Path traversal vulnerability in file parameters CVE: CVE-2026-70428 CVSS: High Description: Jenkins does not properly validate paths in file parameters, allowing attackers to write to arbitrary locations. Fix: Upgrade to 2.576 or LTS 2.568.2. 4. Improper handling of case sensitivity allows privilege escalation CVE: CVE-2026-70429 CVSS: High Description: Jenkins does not properly handle the case sensitivity of usernames and group names, allowing attackers to escalate privileges. Fix: Upgrade to 2.576 or LTS 2.568.2. 5. Users with Overall/Manage permission can instantiate any types related to configuration CVE: CVE-2026-70430 CVSS: Low Description: Jenkins does not restrict the instantiation of configuration-related types, allowing attackers to instantiate arbitrary types. Fix: Upgrade to 2.576 or LTS 2.568.2. 6. Arbitrary code execution vulnerability in Multijob Plugin CVE: CVE-2026-70431 CVSS: High Description: The Multijob Plugin does not properly integrate with the Script Security Plugin, allowing attackers to execute arbitrary code. Fix: Upgrade to 677.v7ffc23d6a_4c2. 7. CSRF vulnerability in Multijob Plugin allows arbitrary code execution CVE: CVE-2026-70432 CVSS: High Description: The Multijob Plugin does not properly validate POST requests, allowing attackers to execute arbitrary code. Fix: Upgrade to 677.v7ffc23d6a_4c2. 8. Missing permission checks in HCL AppScan Plugin allow enumerating credentials IDs CVE: CVE-2026-70433 CVSS: Medium Description: The HCL AppScan Plugin does not properly check permissions, allowing attackers to enumerate credential IDs. Fix: Upgrade to 1.8.4. 9. CSRF vulnerability and missing permission checks in SCM-Manager Plugin CVE: CVE-2026-70434 (CSRF), CVE-2026-70435 (permission check) CVSS: Medium Description: The SCM-Manager Plugin does not properly check permissions and CSRF tokens, allowing attackers to capture credentials. Fix: Upgrade to 1.12.1. 10. Missing permission check in External Workspace Manager Plugin allows reading workspace files CVE: CVE-2026-70436 CVSS: Medium Description: The External Workspace Manager Plugin does not properly check permissions, allowing attackers to read workspace files. Fix: Upgrade to 1.4.2. 11. Non-constant time webhook bearer token comparison in Webhook Secret Credentials Provider Plugin CVE: CVE-2026-70437 CVSS: Low Description: The Webhook Secret Credentials Provider Plugin does not use constant-time comparison, allowing attackers to obtain valid tokens. Fix: Upgrade to 32.v09cb_522f0a_8. 12. Missing permission checks in Parameterized Remote Trigger Plugin allow enumerating credentials IDs CVE: CVE-2026-70438 CVSS: Medium Description: The Parameterized Remote Trigger Plugin does not properly check permissions, allowing attackers to enumerate credential IDs. Fix: No fix available. 13. Missing permission checks in

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Bulletin: Multiple Vulnerabilities Including RCE, Privilege Escalation, and Path Traversal in Core and Plugins