CVE-2026-57296: Jenkins External Workspace Manager Plugin path traversal in exwsAllocate

CVE-2026-57296 · Severity: high · CVSS 8.8 · Published 2026-06-24

The Jenkins External Workspace Manager Plugin, which helps manage disk space for build jobs, contains a security flaw that allows users with job configuration permissions to access files outside of their designated workspace. By exploiting this path traversal vulnerability, an attacker can read sensitive system files on the Jenkins controller. This access can be further leveraged to execute unauthorized commands, potentially leading to a full takeover of the Jenkins server and disruption of the software delivery pipeline.

Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57296 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57296 being exploited in the wild.
How severe is CVE-2026-57296?
High severity, with a CVSS score of 8.8, published 24 June 2026.
Which products and versions are affected?
Jenkins Project External Workspace Manager Plugin <= 1.3.2; org.jenkins-ci.plugins:external-workspace-manager (Maven) < 1.4.0, ECOSYSTEM:introduced=0,fixed=1.4.0.
Is there a fix for CVE-2026-57296?
Yes. org.jenkins-ci.plugins:external-workspace-manager (Maven): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57296 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57296?
Check whether you run Jenkins Project External Workspace Manager Plugin or org.jenkins-ci.plugins:external-workspace-manager (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:external-workspace-manager (Maven): upgrade to 1.4.0 or later
    # set org.jenkins-ci.plugins:external-workspace-manager to 1.4.0 in your pom.xml or build.gradle

Technical details

The Jenkins External Workspace Manager Plugin fails to properly validate or sanitize path traversal sequences (e.g., '../') in the custom workspace path provided to the 'exwsAllocate' Pipeline step. An attacker with 'Item/Configure' permissions can provide a malicious path that escapes the intended workspace directory to access arbitrary files on the Jenkins controller file system. Because Jenkins controller file access often includes sensitive configuration and credentials, this vulnerability can be escalated to achieve remote code execution (RCE). The issue is present in version 1.3.2 and all prior versions. Users should update to a patched version if available or restrict configuration permissions.

Affected products

  • Jenkins Project External Workspace Manager Plugin <= 1.3.2

Identifiers

  • CVE-2026-57296
  • GHSA-hrmj-8fm9-cg8x

Timeline

  • 2026-06-24: disclosed: Initial advisory publication
  • 2026-06-24: advisory: Jenkins Security Advisory 2026-06-24 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.