Jenkins Security Advisory: CVEs for Agent-to-Controller Deserialization Bypass, Arbitrary File Creation, and CSRF RCE

Jenkins Security Advisory 2026-08-05 Vulnerability Summary Vulnerability Overview 1. Agent-to-Controller Deserialization Filter Bypass - CVE: CVE-2026-70426 - Severity: Critical - Description: Jenkins uses the Remoting library for communication between controllers and agents. In Jenkins 2.575 and earlier versions, JEP-200 class filters were not applied to classes resolved via the fallback path, allowing attackers to bypass the JEP-200 deserialization filter. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. - Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. 2. Symlink Following Vulnerability Allows Arbitrary File Creation - CVE: CVE-2026-70427 - Severity: High - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier did not safely handle symbolic links, allowing attackers to write arbitrary files to the controller's filesystem via and archive files. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. - Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. 3. Path Traversal Vulnerability in File Parameter - CVE: CVE-2026-70428 - Severity: High - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier incorrectly identified file paths, allowing attackers to perform path traversal via file parameter names. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. - Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. 4. Improper Case Sensitivity Handling Leads to Privilege Escalation - CVE: CVE-2026-70429 - Severity: High - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier did not properly handle case sensitivity when processing usernames and group names, allowing attackers to create new users or groups that case-insensitively matched existing user or group names. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. - Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. 5. Users with Overall/Manage Permissions Can Instantiate Any Configuration Type - CVE: CVE-2026-70430 - Severity: Low - Description: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier did not restrict the types of objects that could be instantiated, allowing attackers to instantiate configuration objects of any type. - Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. - Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. 6. Arbitrary Code Execution in Multijob Plugin - CVE: CVE-2026-70431 - Severity: High - Description: Multijob plugin versions 669.v9d96a_d9c71b_0 and earlier provided Groovy scripting functionality that was incompatible with the Script Security plugin, allowing attackers to execute arbitrary code. - Affected Versions: Multijob plugin 669.v9d96a_d9c71b_0 and earlier. - Remediation: Upgrade to Multijob plugin 677.v7ffc23d6a_4c2. 7. CSRF Vulnerability in Multijob Plugin Allows Arbitrary Code Execution - CVE: CVE-2026-70432 - Severity: High - Description: Multijob plugin versions 669.v9d96a_d9c71b_0 and earlier did not verify POST requests to form validation endpoints, allowing attackers to execute arbitrary code. - Affected Versions: Multijob plugin 669.v9d96a_d9c71b_0 and earlier. - Remediation: Upgrade to Multijob plugin 677.v7ffc23d6a_4c2. 8. Missing Permissions Check in HCL AppScan Plugin Allows Credential ID Enumeration - CVE: CVE-2026-70433 - Severity: Medium - Description: HCL AppScan plugin versions 1.8.3 and earlier did not perform permissions checks on multiple HTTP endpoints, allowing attackers to enumerate credential IDs. - Affected Versions: HCL AppScan plugin 1.8.3 and earlier. - Remediation: Upgrade to HCL AppScan plugin 1.8.4. 9. CSRF Vulnerability and Missing Permissions Check in SCM-Manager Plugin - CVE: CVE-2026-70434 (CSRF), CVE-2026-70435 (Permissions Check) - Severity: Medium - Description: SCM-Manager plugin versions 1.11.1 and earlier did not perform permissions checks on multiple HTTP endpoints, allowing attackers to capture credentials. - Affected Versions: SCM-Manager plugin 1.11.1 and earlier. - Remediation: Upgrade to SCM-Manager plugin 1.12.1. 10. Missing Permissions Check in External Workspace Manager Plugin Allows Reading Workspace Files - CVE: CVE-2026-70436 - Severity: Medium - Description: External Workspace Manager plugin versions 1.4.1 and earlier did not perform permissions checks, allowing attackers to read workspace files. - Affected Versions: External Workspace Manager plugin 1.4.1 and earlier. - Remediation: Upgrade to External Workspace Manager plugin 1.4.2. 11. Non-Constant-Time Webhook Bearer Token Comparison in Webhook Secret Credentials Provider Plugin - CVE: CVE-2026-70437 - Severity: Low - Description: Webhook Secret Credentials Provider plugin versions 16.v0cf_a0215cf5 and earlier did not use constant-time comparison functions, allowing attackers to obtain valid webhook bearer tokens via statistical methods. - Affected Versions: Webhook Secret Credentials Provider plugin 16.v0cf_a0215cf5 and earlier. - Remediation: Upgrade to Webhook Secret Cre

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: CVEs for Agent-to-Controller Deserialization Bypass, Arbitrary File Creation, and CSRF RCE