Jenkins: Critical Jenkins Vulnerability Allows Attackers to Execute Malicious Code on Controller

Critical Jenkins Vulnerability (CVE-2026-70426) Enables Remote Code Execution

Jenkins has disclosed a critical security flaw (CVE-2026-70426) that allows attackers to bypass security filters and execute arbitrary code on Jenkins controllers. The vulnerability, rated with a Critical CVSS score, stems from a gap in the JEP-200 class filter used to block unsafe Java deserialization in agent-to-controller communications.

Affected Versions

The flaw impacts:

• Jenkins 2.575 and earlier
• Jenkins LTS 2.568.1 and earlier
• Remoting library versions 3384.v60d89463d9e0 and earlier (excluding 3355.3357.v931d3c992987)

Exploitation Mechanism

Jenkins relies on the Remoting library (agent.jar/remoting.jar) for controller-agent communication, which involves serialized Java objects. While the JEP-200 filter is designed to block dangerous classes, researchers discovered a fallback deserialization path that bypasses this protection.

An attacker with control over an agent, code execution on an existing agent, or Jenkins Agent/Connect permissions could exploit this flaw to deserialize restricted Java classes, leading to arbitrary code execution on the controller.

Impact & Risks

A compromised Jenkins controller poses severe risks, including:

• Exposure of source code, secrets, and build credentials
• Access to deployment keys and software supply chain pipelines
• Full control over CI/CD environments

The attack surface is limited to classes in the Jenkins core classpath (bundled with Jenkins or the Java platform), excluding plugin dependencies.

Mitigation & Fixes

Jenkins addressed the issue in:

• Jenkins 2.576
• Jenkins LTS 2.568.2

These updates enforce the JEP-200 filter even in the fallback deserialization path. Organizations are advised to upgrade immediately and review Agent/Connect permissions to reduce exposure.

For environments unable to patch immediately, Jenkins has provided a temporary workaround in its SECURITY-3911-3930 GitHub repository. The flaw was reported through the European Commission’s Jenkins Bug Bounty Program.

Source: https://cybersecuritynews.com/jenkins-code-execution-vulnerability/

Jenkins TPRM report: https://www.rankiteo.com/company/jenkinsio

"id": "jen1786026533",
"linkid": "jenkinsio",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'DevOps/Continuous Integration',
                        'name': 'Jenkins',
                        'type': 'Software'}],
 'attack_vector': 'Agent-to-controller communication (serialized Java objects)',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Source code',
                                              'Secrets',
                                              'Build credentials',
                                              'Deployment keys']},
 'description': 'Jenkins disclosed a critical security flaw (CVE-2026-70426) '
                'that allows attackers to bypass security filters and execute '
                'arbitrary code on Jenkins controllers. The vulnerability '
                'stems from a gap in the JEP-200 class filter used to block '
                'unsafe Java deserialization in agent-to-controller '
                'communications.',
 'impact': {'data_compromised': ['Source code',
                                 'Secrets',
                                 'Build credentials',
                                 'Deployment keys'],
            'operational_impact': 'Full control over CI/CD environments',
            'systems_affected': 'Jenkins controllers'},
 'post_incident_analysis': {'corrective_actions': 'Enforce JEP-200 filter in '
                                                  'fallback deserialization '
                                                  'path',
                            'root_causes': 'Gap in JEP-200 class filter '
                                           'allowing fallback deserialization '
                                           'path'},
 'recommendations': ['Upgrade to Jenkins 2.576 or LTS 2.568.2 immediately',
                     'Review Agent/Connect permissions to reduce exposure',
                     'Apply temporary workaround from Jenkins '
                     'SECURITY-3911-3930 GitHub repository if patching is not '
                     'immediately possible'],
 'references': [{'source': 'Jenkins Security Advisory',
                 'url': 'https://github.com/jenkinsci/security-advisories'}],
 'response': {'remediation_measures': 'Upgrade to Jenkins 2.576 or LTS '
                                      '2.568.2'},
 'title': 'Critical Jenkins Vulnerability (CVE-2026-70426) Enables Remote Code '
          'Execution',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-70426 (JEP-200 class filter bypass)'}