Executive brief
Jenkins is an automation server widely used for continuous integration and deployment pipelines. A flaw in how Jenkins deserializes configuration files allows attackers with configuration update permissions to inject malicious values into transient fields, potentially leading to remote code execution depending on how those fields are used. This could allow an attacker to gain unauthorized access to the Jenkins system and execute arbitrary code.
Technical details
This vulnerability is a deserialization flaw in Jenkins' use of XStream for loading and saving configuration and build data. Transient fields, which normally should not be serialized, can be included during deserialization of user-submitted config.xml documents. Attackers able to submit configuration updates (typically users with Overall/Read or configuration update permissions) can craft XML payloads that specify values for transient fields. The impact depends on how those fields are subsequently used; in certain cases, this can lead to remote code execution via the Script Console. Jenkins 2.580 and LTS 2.568.3 fix this by preventing transient fields from being included during deserialization.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Jenkins 2.580, LTS 2.568.3