SB2026080641 - Multiple vulnerabilities in Jenkins and Jenkins LTS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080641

SB2026080641 - Multiple vulnerabilities in Jenkins and Jenkins LTS

Published: August 6, 2026

Security Bulletin ID SB2026080641
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 40% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-70426)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data while missing the JEP-200 class filter. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Improper access control (CVE-ID: CVE-2026-70430)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the affected application does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. A remote administrator can instantiate any types related to configuration .


3) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-70429)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper handling of case sensitivity in user names and group names. A remote attacker can gain elevated privileges on the target system.


4) Path traversal (CVE-ID: CVE-2026-70428)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in file parameters. A remote user can send a specially crafted HTTP request and write arbitrary files on the system.


5) Link following (CVE-ID: CVE-2026-70427)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an insecure link following issue during the extraction of .tar and .tar.gz archives. A remote user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.


Remediation

Install update from vendor's website.

References