Executive brief
Jenkins, a widely-used continuous integration and delivery server, has a flaw in how it serializes data to JSON and Python formats via its REST API. Attackers who can control map property names can inject arbitrary fields into API responses, potentially leading to information disclosure or manipulation of Jenkins configuration and operational data.
Technical details
The vulnerability is an improper output encoding flaw in Jenkins' REST API JSON and Python serialization logic. When serializing objects with map-type properties, Jenkins fails to escape map keys before inserting them into JSON and Python API responses. An attacker able to control map property names (typically through configuration or object submission) can inject arbitrary fields into these responses. This requires network access to the REST API and the ability to control object properties—often possible for users with permissions to modify configurations. The impact includes information disclosure through field injection and potential manipulation of API consumer behavior if downstream systems trust the injected fields. Fix: upgrade to Jenkins 2.580 or LTS 2.568.3 or later.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: advisory: Jenkins Security Advisory 2026-09-02