Executive brief
The Jenkins Performance Plugin is used by development teams to track build performance metrics over time. When Jenkins loads cached performance reports from previous builds, the plugin deserializes data without properly restricting which classes can be instantiated. An attacker with permission to configure jobs can exploit this to run malicious code directly on the Jenkins server, potentially compromising all builds, credentials, and connected systems.
Technical details
The Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier contains an unsafe deserialization vulnerability in its handling of cached performance reports stored in the build directory. The vulnerability lies in the use of Java deserialization (via XStream) without appropriate class restrictions when loading these cached objects. An attacker with Item/Configure permission can craft malicious serialized objects that, when deserialized during build execution or report loading, instantiate arbitrary classes leading to remote code execution on the Jenkins controller. The vulnerability is triggered when the plugin processes cached performance report data from previous builds, and no validation restricts the object types being deserialized. Patched versions restrict the classes that can be instantiated during deserialization.
Affected products
- Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier
Timeline
- 2026-09-02: disclosed: Jenkins Security Advisory 2026-09-02