Jenkins: Critical Jenkins Vulnerability Exposes Build Servers to Controller Takeover

Critical Jenkins Vulnerability (CVE-2026-70426) Enables Remote Code Execution on Controllers

A severe vulnerability in Jenkins, tracked as SECURITY-3911 and CVE-2026-70426, allows attackers with Agent/Connect permissions or malicious Jenkins agents to execute arbitrary code on a Jenkins controller. The flaw, rated Critical (CVSS 9.0), stems from a bypass in the JEP-200 class filter, a security mechanism designed to restrict deserialization of untrusted Java objects in the Remoting library.

Vulnerability Details

Jenkins uses the Remoting library (agent.jar/remoting.jar) to facilitate serialized object communication between controllers and build agents. While JEP-200 was introduced to block dangerous deserialization, researchers discovered that Remoting versions 3384.v60d89463d9e0 and earlier (excluding 3355.3357.v931d3c992987) fail to enforce the filter on classes resolved via a fallback deserialization path. Attackers can exploit this gap by crafting malicious serialized objects that load eligible classes from the Jenkins core classpath, leading to unrestricted code execution on the controller.

Impact & Risks

A compromised Jenkins controller grants attackers access to:

• Build pipelines (modification, tampering, or injection of malicious code)
• Stored credentials (source-control tokens, cloud access keys, artifact repository logins)
• Deployment environments (pivoting into corporate systems)
• Release artifacts (supply chain attacks via altered binaries)

The vulnerability affects Jenkins 2.575 and earlier, as well as LTS 2.568.1 and earlier. Jenkins has released fixes in 2.576 and LTS 2.568.2, which enforce JEP-200 protections on the fallback path.

Mitigation & Workarounds

While upgrading is the recommended solution, administrators unable to patch immediately can apply a vendor-provided workaround from the Jenkins SECURITY-3911-3930 GitHub repository. Additional defensive measures include:

• Restricting Agent/Connect permissions to trusted systems
• Isolating build agents from untrusted workloads
• Monitoring controller logs for suspicious Remoting activity

  Source: https://cyberpress.org/critical-jenkins-vulnerability/

  Jenkins cybersecurity rating report: https://www.rankiteo.com/company/jenkinsio

"id": "JEN1786011835",
"linkid": "jenkinsio",
"type": "Vulnerability",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'DevOps/Continuous Integration',
                        'name': 'Jenkins',
                        'type': 'Software'}],
 'attack_vector': 'Malicious serialized objects via Remoting library',
 'data_breach': {'sensitivity_of_data': 'High (source-control tokens, cloud '
                                        'access keys, artifact repository '
                                        'logins)',
                 'type_of_data_compromised': ['Stored credentials',
                                              'Build pipelines',
                                              'Deployment environments',
                                              'Release artifacts']},
 'description': 'A severe vulnerability in Jenkins, tracked as SECURITY-3911 '
                'and CVE-2026-70426, allows attackers with Agent/Connect '
                'permissions or malicious Jenkins agents to execute arbitrary '
                'code on a Jenkins controller. The flaw stems from a bypass in '
                'the JEP-200 class filter, a security mechanism designed to '
                'restrict deserialization of untrusted Java objects in the '
                'Remoting library.',
 'impact': {'data_compromised': 'Stored credentials (source-control tokens, '
                                'cloud access keys, artifact repository '
                                'logins), build pipelines, deployment '
                                'environments, release artifacts',
            'operational_impact': 'Modification or tampering of build '
                                  'pipelines, supply chain attacks via altered '
                                  'binaries, pivoting into corporate systems',
            'systems_affected': 'Jenkins controllers, build agents'},
 'post_incident_analysis': {'corrective_actions': 'Enforce JEP-200 protections '
                                                  'on fallback deserialization '
                                                  'path in Remoting library',
                            'root_causes': 'Bypass in JEP-200 class filter in '
                                           'Remoting library (versions '
                                           '3384.v60d89463d9e0 and earlier), '
                                           'allowing unrestricted '
                                           'deserialization of malicious Java '
                                           'objects'},
 'recommendations': 'Upgrade to Jenkins 2.576 or LTS 2.568.2, restrict '
                    'Agent/Connect permissions, isolate build agents, monitor '
                    'controller logs, apply vendor-provided workaround if '
                    'immediate patching is not possible.',
 'references': [{'source': 'Jenkins SECURITY-3911-3930 GitHub repository',
                 'url': 'https://github.com/jenkinsci/security-advisories'}],
 'response': {'containment_measures': 'Restricting Agent/Connect permissions '
                                      'to trusted systems, isolating build '
                                      'agents from untrusted workloads, '
                                      'monitoring controller logs for '
                                      'suspicious Remoting activity',
              'enhanced_monitoring': 'Monitoring controller logs for '
                                     'suspicious Remoting activity',
              'remediation_measures': 'Upgrading to Jenkins 2.576 or LTS '
                                      '2.568.2, applying vendor-provided '
                                      'workaround from SECURITY-3911-3930 '
                                      'GitHub repository'},
 'title': 'Critical Jenkins Vulnerability (CVE-2026-70426) Enables Remote Code '
          'Execution on Controllers',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-70426 (SECURITY-3911)'}