Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:29.193Z",
  "pubdate": "2026-09-02T16:17:29.193Z",
  "executiveSummary": "This vulnerability involves a critical flaw in how Jenkins handles user-submitted config.xml documents, specifically regarding the deserialization and processing of nested object types. The vulnerability allows an attacker to manipulate Stapler-managed HTTP requests, leading to remote code execution (RCE) on the host system.\nThe flaw affects Jenkins core versions 2.579 and earlier, as well as LTS versions 2.568.2 and earlier. By injecting malicious object configurations into top-level configuration files, unauthorized actors can execute arbitrary code within the context of the Jenkins process.\nThis represents a high-severity risk, as successful exploitation bypasses standard security boundaries. The impact includes full compromise of the Jenkins controller, potentially leading to unauthorized system access, data exfiltration, and lateral movement within the underlying network infrastructure.\nExploitation requires the ability to submit or modify configuration documents. Given the broad nature of Jenkins integrations, this vulnerability poses a severe threat to environments where configuration APIs or XML import features are exposed or accessible to users with sufficient permissions.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of object types defined to store configuration in independent top-level files, such as global configurations or job definitions. Jenkins utilizes the Stapler framework to map HTTP requests to Java object methods. The vulnerability occurs when these restricted object types are permitted to appear as nested field values within an externally provided config.xml document.\nDuring the processing of a config.xml file, the Jenkins core fails to adequately validate or restrict the nested instantiation of these sensitive types. Because these objects are designed to be top-level entities, their secondary instantiation via a nested structure allows for the manipulation of the object graph during the Stapler data-binding process.\nThe attack flow proceeds as follows: An attacker crafts a malicious config.xml payload containing a serialized object of an affected type, nested within a legitimate configuration structure. When this document is submitted to the Jenkins server—via API endpoints or configuration management interfaces—the Stapler framework binds the XML to the underlying Java model. Because the validator does not distinguish between legitimate top-level usage and malicious nested injection, it inadvertently triggers the instantiation of these objects.\nOnce the object is instantiated within the memory space of the Jenkins controller, the attacker can leverage the properties of the injected object to influence subsequent HTTP request handling. By carefully crafting the nested configuration, the attacker can manipulate Stapler to execute methods that facilitate code execution. This behavior effectively turns the configuration parsing mechanism into an execution primitive.\nAffected versions include Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier. The vulnerability is network-exploitable, assuming the attacker has the necessary permissions to update or interact with job configurations or global settings. Privilege requirements depend on the specific Jenkins security realm configuration, but typically necessitate credentials that allow for the modification of XML configuration files or the submission of job definitions.\nThe post-exploitation impact is catastrophic, as the attacker achieves Remote Code Execution (RCE) with the privileges of the Jenkins service user. This allows for the execution of arbitrary commands, modification of system files, and the installation of persistence mechanisms within the Jenkins environment, ultimately compromising the integrity and confidentiality of the entire CI/CD pipeline."
}