Jenkins Core and Plugins Plagued by Multiple Critical Vulnerabilities
Jenkins has issued a security advisory detailing critical vulnerabilities in its core and numerous plugins, including deserialization bypass, path traversal, and privilege escalation flaws.
Jenkins, a widely used automation server, has released a comprehensive security advisory on August 5, 2026, addressing a significant number of vulnerabilities affecting its core platform and a variety of popular plugins. The advisory highlights issues ranging from critical remote code execution possibilities to high-severity path traversal and privilege escalation flaws, urging users to update immediately.
One of the most critical vulnerabilities, identified as SECURITY-3911 (CVE-2026-70426), involves an agent-to-controller deserialization filter bypass. This flaw exists in older versions of the Remoting library used for controller-agent communication. Attackers with Agent/Connect permission can exploit this by sending crafted serialized objects to bypass Jenkins's JEP-200 class filter, potentially leading to code execution on the Jenkins controller. While Jenkins versions 2.576 and LTS 2.568.2 have patched this by applying the class filter to the fallback code path, older versions remain vulnerable.
Another high-severity issue, SECURITY-3930 (CVE-2026-70427), concerns improper handling of symbolic links with empty names during the extraction of .tar and .tar.gz archives. This vulnerability allows attackers controlling agent processes to create archives that, when extracted on the controller, can write files to arbitrary locations. This could be leveraged to execute code by placing malicious scripts in the JENKINS_HOME/init.groovy.d/ directory or by deploying malicious plugins. Patched versions refuse to extract such archives.
Furthermore, Jenkins versions prior to 2.576 and LTS 2.568.2 are affected by SECURITY-3927 (CVE-2026-70428), a path traversal vulnerability in file parameters. Attackers with Item/Configure and Item/Build permissions can exploit this to write files to arbitrary locations on the controller, again posing a risk of code execution. The fix in newer versions improves the identification of malicious file paths.
Privilege escalation is also a concern with SECURITY-3924 (CVE-2026-70429), a flaw related to improper handling of case sensitivity in user and group names. Inconsistent comparisons between lowercasing canonical IDs and case-insensitive string comparisons allow attackers to impersonate other users or gain their permissions, provided the security realm permits such characters and user creation. The fix ensures that usernames and group names are compared using their canonical forms.
Several plugins are also impacted, including AWS CodeBuild, CodeSonar, Google Chat Notification, and Multijob, among others. These plugin-specific vulnerabilities range in severity and could lead to arbitrary code execution, information disclosure, or other security risks. Users are strongly advised to consult the full advisory for details on affected plugins and their respective patches.
Jenkins has provided workarounds for some of these vulnerabilities for users unable to update immediately, directing them to specific GitHub repositories for detailed instructions. However, the primary recommendation remains to update Jenkins core and all affected plugins to the latest patched versions to mitigate these widespread security risks.