Executive brief
Jenkins is an open-source automation server used to orchestrate build pipelines and continuous deployment workflows. An attacker with low-level permissions can submit a specially crafted configuration file that causes Jenkins to deserialize malicious data, allowing them to impersonate any user, execute arbitrary code via the Script Console, or read sensitive files from the server. This provides a direct path to complete system compromise and credential theft.
Technical details
This is a CWE-502 unsafe deserialization vulnerability in Jenkins' configuration handling. Jenkins uses XStream for serialization/deserialization of configuration files, and implements a custom filter (JEP-200) to restrict deserialization to known-safe types. However, versions 2.567 and earlier (LTS 2.555.2 and earlier) permit deserialization of any type defined in Jenkins core or plugins from attacker-controlled config.xml submissions. An attacker with Overall/Read permission plus either a user account or config.xml POST capability (e.g., Item/Configure, View/Configure, Agent/Configure) can craft a config.xml payload containing arbitrary types with attacker-controlled behavior. These deserialized objects can then intercept HTTP requests due to Jenkins' Stapler web framework routing, enabling user impersonation, Script Console access for RCE, and arbitrary file disclosure. Jenkins 2.568 and LTS 2.555.3 restrict deserialization to expected types only.
Affected products
- Jenkins jenkins-core < 2.555.3, >= 2.556 < 2.568
Timeline
- 2026-06-10: disclosed
- 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released
References
- https://www.jenkins.io/security/advisory/2026-06-10/
- https://access.redhat.com/security/cve/CVE-2026-53435
- https://bugzilla.redhat.com/show_bug.cgi?id=2487539
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53435.json
- https://github.com/jenkinsci/jenkins/commit/345a3190a49d1ac96c4ff1c2e9eef4102c8d63f6