Do Son 
TL;DR
Jenkins patched a critical Jenkins vulnerability, CVE-2026-70426, that bypasses the JEP-200 deserialization filter. Attackers with Agent/Connect permission can run code on the controller. The August 5, 2026 advisory also fixes 22 other flaws.
Why This Jenkins Vulnerability Matters
The Jenkins controller is the brain of most CI/CD pipelines. Consequently, code execution there exposes source code, build secrets, and deployment credentials.
This flaw carries a Critical CVSS rating. Moreover, it undermines JEP-200, the core defense Jenkins built to stop Java deserialization attacks. According to the official Jenkins security advisory, the bug was found through the Bug Bounty Program sponsored by the European Commission.
How the Attack Works
Jenkins uses the Remoting library to link the controller and its agents. It sends serialized Java objects across that channel. To stay safe, it applies the JEP-200 class filter during deserialization.
However, Remoting 3384.v60d89463d9e0 and earlier skipped that filter on a fallback resolution path. As a result, an attacker with Agent/Connect permission can slip dangerous classes past the check. The gap covers classes on the Jenkins core classpath, which can then trigger remote code execution.
Affected Versions
The following releases are vulnerable to CVE-2026-70426:
- Jenkins weekly up to and including 2.575
- Jenkins LTS up to and including 2.568.1
Jenkins runs on a very large share of self-hosted automation servers, so the exposed population is likely substantial, based on the vendor’s platform reach.
Related Vulnerabilities in the Same Advisory
The advisory bundles several high-severity issues alongside the deserialization bug.
CVE-2026-70427: Arbitrary File Creation
Jenkins mishandles symbolic links with empty names during archive extraction. Therefore, an attacker controlling an agent can write files anywhere the Jenkins user can reach.
CVE-2026-70428: Path Traversal in File Parameters
Jenkins misreads file paths in parameter names. As a result, users with Item/Configure and Item/Build rights can write files to arbitrary controller locations, which can lead to code execution.
Exploitation Status
No exploitation in the wild has been confirmed. Additionally, no public proof-of-concept exists at publication time. Still, the Critical rating makes fast patching wise.
Patch and Mitigation Steps
Update to a fixed release right away. Specifically, apply these versions:
- Jenkins weekly: upgrade to 2.576
- Jenkins LTS: upgrade to 2.568.2
These builds apply the class filter on the fallback path. If you cannot patch now, a workaround exists in the linked GitHub repository. Admins should also review agent permissions and restrict Agent/Connect access.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
