Jenkins's August 5, 2026 security advisory patches four vulnerabilities in Jenkins core, including a Critical-rated deserialization filter bypass (CVE-2026-70426) that can be exploited without a valid account. Three High-severity flaws address additional paths to arbitrary file write and privilege escalation on the Jenkins controller. All issues are fixed in Jenkins 2.576 (weekly) and Jenkins LTS 2.568.2, released August 5, 2026.

The Four CVEs

CVE-2026-70426 — Critical — Deserialization filter bypass (SECURITY-3911)

Jenkins uses the Remoting library to pass serialized Java objects between the controller and build agents. To guard against deserialization vulnerabilities, Jenkins enforces the JEP-200 class filter on incoming Remoting traffic. In Jenkins 2.575 and earlier (Remoting ≤ 3384.v60d89463d9e0, except 3355.3357.v931d3c992987), that filter is not applied on a fallback code path within the deserialization implementation.

An attacker who can reach a Jenkins controller via the Remoting channel — either by running code on a build agent, or by holding Agent/Connect permission — can send a crafted object through the unfiltered fallback path and execute arbitrary code on the Jenkins controller JVM. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the fact that exploitation requires network-level Remoting access (high complexity) but no valid credentials in the traditional sense.

A workaround is available from JetBrains (see the SECURITY-3911-3930 repository) for cases where immediate upgrade is not possible. Jenkins 2.576 / LTS 2.568.2 apply the class filter on the fallback path.

CVE-2026-70427 — High — Symlink tar extraction to arbitrary path (SECURITY-3930)

Jenkins 2.575 and earlier do not safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. An attacker who controls an agent process can provide a crafted archive to the controller that writes files to arbitrary locations on the controller's filesystem, restricted only by the OS permissions of the Jenkins process. Writing to JENKINS_HOME/init.groovy.d/ achieves code execution on next startup; writing to JENKINS_HOME/plugins/ deploys a malicious plugin. This is an incomplete fix of SECURITY-3657 (March 2026). Fixed in Jenkins 2.576 / LTS 2.568.2.

CVE-2026-70428 — High — Path traversal in file parameter names (SECURITY-3927)

Jenkins 2.575 and earlier improperly validate file parameter names for path traversal attempts. An attacker with Item/Configure and Item/Build permissions can specify a crafted file parameter name that writes the parameter's content to an arbitrary controller filesystem location. As with CVE-2026-70427, writing to init.groovy.d/ or plugins/ enables code execution. Fixed in Jenkins 2.576 / LTS 2.568.2.

CVE-2026-70429 — High — Unicode case-sensitivity privilege escalation (SECURITY-3924)

Jenkins 2.575 and earlier create canonical IDs for users and groups by lowercasing names, but compare them using Java's String#equalsIgnoreCase, which considers certain Unicode characters (e.g., the dotless-i ı) equivalent to their ASCII counterparts when the lowercase versions differ. An attacker who can create users or groups (requiring a permissive security realm) can register a name that case-insensitively matches an existing user or admin, and then be granted that account's permissions. Fixed in Jenkins 2.576 / LTS 2.568.2, which compares canonical (lowercased) forms only.

Affected and Fixed Versions

TrackAffectedFixed
Jenkins weekly≤ 2.5752.576
Jenkins LTS≤ 2.568.12.568.2

Who Is Affected?

CVE-2026-70426: Any Jenkins controller reachable by a build agent or by a user with Agent/Connect permission. This covers virtually all Jenkins deployments that use distributed builds. Controllers with no agents attached and no external Remoting access are not exposed to this specific vector, but are still affected by the other three CVEs.

CVE-2026-70427: Any Jenkins controller that receives archive artifacts from build agents — a standard part of most pipeline configurations.

CVE-2026-70428: Any controller where non-admin users have Item/Configure + Item/Build permissions — a typical developer permission set.

CVE-2026-70429: Controllers using security realms that allow Unicode characters in usernames (LDAP, external SSO). The bundled Jenkins user database restricts usernames to ASCII, so that realm is not directly exploitable.

What to Do

  1. Upgrade Jenkins core to 2.576 (weekly) or 2.568.2 (LTS). This is the complete fix for all four CVEs. From the Jenkins web UI: Manage Jenkins → Jenkins Upgrade, or from the command line: 
    # Download the latest weekly WAR
wget https://updates.jenkins.io/latest/jenkins.war -O /opt/jenkins/jenkins.war
# Or for LTS:
wget https://updates.jenkins.io/stable/latest/jenkins.war -O /opt/jenkins/jenkins.war

sudo systemctl restart jenkins
  2. If you cannot upgrade immediately, apply the CVE-2026-70426 workaround. The Jenkins security team has published a workaround at github.com/jenkinsci-cert/SECURITY-3911-3930. Apply it and plan to upgrade as soon as possible — the workaround does not address CVE-2026-70427 through -70429.
  3. Restrict Agent/Connect permissions to trusted users only. CVE-2026-70426 is most exploitable by accounts that can register agents. Audit who holds this permission under Manage Jenkins → Security → Authorization and remove it from accounts that don't need it.
  4. Review the JENKINS_HOME/init.groovy.d/ and JENKINS_HOME/plugins/ directories for any unexpected files, which could indicate prior exploitation of CVE-2026-70427 or -70428.
  5. Audit user and group accounts for suspicious Unicode lookalikes if you use LDAP or external SSO, especially any accounts that appear to duplicate an admin name.
  6. Keep Jenkins plugins updated. The same advisory patches multiple plugins (Multijob, SCM-Manager, External Workspace Manager, Webhook Secret Credentials Provider, HCL AppScan). Update all affected plugins via Manage Jenkins → Plugins → Updates.

Quick-Win Checklist

  • Check your Jenkins version at Manage Jenkins → About Jenkins.
  • Upgrade to Jenkins 2.576 (weekly) or Jenkins LTS 2.568.2 immediately.
  • If upgrade is delayed: apply the SECURITY-3911 workaround from the Jenkins security cert repo.
  • Audit Agent/Connect permission holders and restrict to trusted accounts only.
  • Inspect JENKINS_HOME/init.groovy.d/ and JENKINS_HOME/plugins/ for unexpected files.
  • Update all affected plugins (Multijob, SCM-Manager, External Workspace Manager, Webhook Secret Credentials Provider, HCL AppScan).
  • If using LDAP/SSO: audit user accounts for Unicode-lookalike names duplicating admin accounts.

Sources