Executive brief
Stapler, the web framework used by Jenkins (an automation server managing continuous integration/deployment), fails to restrict object types that can be created from form data. An attacker with basic read access can exploit this to instantiate configuration objects they shouldn't be able to create, potentially gaining control over system settings or executing arbitrary code.
Technical details
The vulnerability is a type restriction bypass in Stapler's form data binding logic (SECURITY-3915). Stapler instantiates configuration objects based on types specified in form submissions without validating that the instantiated type is compatible with the expected field type. An attacker with Overall/Read permission can submit crafted form data containing any configuration-related type, not just those intended for that specific field. This allows instantiation of arbitrary configuration objects (e.g., security realm, agent launcher) that may have security implications. The fix in Jenkins 2.580 and LTS 2.568.3 enforces strict type compatibility checking in Stapler's form binding.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
- Stapler Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Jenkins 2.580, LTS 2.568.3