Executive brief
Jenkins, a popular automation server used to build, test, and deploy software, contains a vulnerability in how it deserializes XML configuration data. Attackers with read-level access can craft malicious XML to create fake user objects, which could be leveraged in combination with other vulnerabilities to gain administrative access or execute arbitrary code on the Jenkins server.
Technical details
This is a deserialization vulnerability (CWE-502) affecting Jenkins' use of XStream for configuration persistence. Jenkins normally restricts which types can be deserialized through a custom filter (JEP-200), but in versions 2.579 and earlier (LTS 2.568.2 and earlier), user objects can appear as nested field values in other deserialized XML objects, bypassing type restrictions. An attacker with Overall/Read permission can submit crafted XML to create user objects that are not actual Jenkins accounts but can be instantiated and manipulated. While the created objects cannot directly log in, they become dangerous when combined with other vulnerabilities (particularly SECURITY-3972 / CVE-2026-84645, which allows nested PersistenceRoot objects to access the Script Console). Jenkins 2.580 and LTS 2.568.3 fix this by declaring user objects as top-level configuration files, preventing their deserialization as nested field values.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
Timeline
- 2026-09-02: disclosed