CVE-2026-53439: Jenkins missing permission checks in user profile endpoints

CVE-2026-53439 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Jenkins, a popular automation server used for continuous integration and deployment, contains authorization bypass flaws that allow users with basic read permissions to discover other users' timezone settings and enumerate private views. An attacker with minimal privileges can exploit this to gather information about other users and their Jenkins configurations, potentially facilitating social engineering or further attacks.

Technologies: Jenkins, org.jenkins-ci.main:jenkins-core (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-53439 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53439 being exploited in the wild.
How severe is CVE-2026-53439?
Medium severity, with a CVSS score of 4.3, published 10 June 2026.
Which products and versions are affected?
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.
Is there a fix for CVE-2026-53439?
Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53439 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-53439?
Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later
    # set org.jenkins-ci.main:jenkins-core to 2.555.3 in your pom.xml or build.gradle

Technical details

This vulnerability (SECURITY-3713 / CVE-2026-53439) results from missing authorization checks in HTTP endpoints exposed by Jenkins core. An attacker with Overall/Read permission (the minimal Jenkins privilege level) can access endpoints that return sensitive user profile information without performing additional permission validation. Specifically, the affected endpoints leak (1) timezone configuration for arbitrary users and (2) view names from other users' private "My Views" collections. The root cause is the absence of permission checks before returning this user profile data; the fix adds explicit permission checks (e.g., Jenkins.ADMINISTER or user identity verification) before serving this information. The attack requires network access to Jenkins and at least Overall/Read permission, but no additional user interaction or privileges. Patches are available in Jenkins 2.568 and LTS 2.555.3, which enforce proper authorization checks in the affected endpoints.

Affected products

  • Jenkins Jenkins 2.567 and earlier, LTS 2.555.2 and earlier
  • Jenkins jenkins-core < 2.555.3 and >= 2.556, < 2.568

Identifiers

  • CVE-2026-53439
  • GHSA-g28p-6mcc-v4rv

Timeline

  • 2026-06-10: disclosed: Jenkins Security Advisory published; CVE-2026-53439 assigned
  • 2026-06-10: patched: Patches released in Jenkins 2.568 and LTS 2.555.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.